skills/garrytan/gstack/setup-gbrain/Gen Agent Trust Hub

setup-gbrain

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests Claude and Codex session history and dynamic instruction blocks into a knowledge base used for context retrieval, creating a surface for indirect prompt injection.\n
  • Ingestion points: Claude and Codex session transcripts (JSONL files) stored on the local machine and GSTACK_INSTRUCTION blocks produced by the gstack-skill-start local binary.\n
  • Boundary markers: Context retrieved from the brain is rendered within <USER_TRANSCRIPT_DATA ...> envelopes when added to the agent's preamble.\n
  • Capability inventory: The skill utilizes the Bash, Write, and Edit tools and has the capability to register persistent MCP servers that can execute arbitrary commands.\n
  • Sanitization: An opt-in secret scanning feature using gitleaks is available to detect and block transcripts containing sensitive credentials before they are ingested.\n- [DATA_EXFILTRATION]: The skill is designed to synchronize local data to external platforms as part of its core functionality.\n
  • Synchronizes 'artifacts' such as plans, designs, and learnings to a private Git repository on GitHub or GitLab.\n
  • Transfers session transcripts and code indices to a Supabase database or a remote HTTP-linked gbrain server.\n- [COMMAND_EXECUTION]: Orchestrates the installation and configuration of software through shell commands and local binaries.\n
  • Executes local management binaries from the ~/.claude/skills/gstack/bin/ directory for system state detection and project provisioning.\n
  • Uses claude mcp add to register the gbrain serve command as an MCP tool, allowing the agent to execute brain queries in subsequent sessions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 10:47 AM