setup-gbrain
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests Claude and Codex session history and dynamic instruction blocks into a knowledge base used for context retrieval, creating a surface for indirect prompt injection.\n
- Ingestion points: Claude and Codex session transcripts (JSONL files) stored on the local machine and
GSTACK_INSTRUCTIONblocks produced by thegstack-skill-startlocal binary.\n - Boundary markers: Context retrieved from the brain is rendered within
<USER_TRANSCRIPT_DATA ...>envelopes when added to the agent's preamble.\n - Capability inventory: The skill utilizes the
Bash,Write, andEdittools and has the capability to register persistent MCP servers that can execute arbitrary commands.\n - Sanitization: An opt-in secret scanning feature using
gitleaksis available to detect and block transcripts containing sensitive credentials before they are ingested.\n- [DATA_EXFILTRATION]: The skill is designed to synchronize local data to external platforms as part of its core functionality.\n - Synchronizes 'artifacts' such as plans, designs, and learnings to a private Git repository on GitHub or GitLab.\n
- Transfers session transcripts and code indices to a Supabase database or a remote HTTP-linked gbrain server.\n- [COMMAND_EXECUTION]: Orchestrates the installation and configuration of software through shell commands and local binaries.\n
- Executes local management binaries from the
~/.claude/skills/gstack/bin/directory for system state detection and project provisioning.\n - Uses
claude mcp addto register thegbrain servecommand as an MCP tool, allowing the agent to execute brain queries in subsequent sessions.
Audit Metadata