setup-browser-cookies
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Bun runtime installation script from the well-known official domain
bun.sh. The skill includes a security measure to verify the script against a hardcoded SHA256 checksum (bab8acfb...) before execution. - [REMOTE_CODE_EXECUTION]: Executes the verified Bun installation script using Bash to set up the required runtime environment if it is not already present on the system.
- [COMMAND_EXECUTION]: Invokes numerous local binaries and scripts located within the vendor's directory (
~/.claude/skills/gstack/bin/) to handle configuration, telemetry logging, and skill state management. - [DATA_EXFILTRATION]: Contains opt-in telemetry logic that shares anonymized usage data (skill name, duration, outcome, and a stable device ID) with the author's infrastructure. It also provides an optional feature to sync generated artifacts to a private GitHub repository for cross-machine indexing.
- [COMMAND_EXECUTION]: Uses dynamic execution patterns such as
evaland shell sourcing (source <(...)) to load environment variables and configurations produced by local vendor binaries.
Audit Metadata