spec
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses eval to execute output from the local gstack-slug script to set environment variables for context recovery.
- [COMMAND_EXECUTION]: The workflow relies on executing various local binaries (gstack-skill-start, gstack-redact, etc.) and system utilities like git and gh. It also spawns new claude agent processes when the --execute flag is used.
- [INDIRECT_PROMPT_INJECTION]: User-provided content is passed to an external model (Codex) for evaluation. The skill attempts to mitigate injection risks using delimiters (<<<USER_SPEC>>>) and a dedicated redaction scan to prevent PII or secret leakage.
- Ingestion points: User-provided feature requests and the resulting specification draft.
- Boundary markers: Hard delimiters and explicit 'ignore instructions' directives are used in the prompt sent to the reviewer model.
- Capability inventory: The skill has broad capabilities including file reading, bash execution, and GitHub API access.
- Sanitization: A semantic review and a fail-closed redaction tool (gstack-redact) are used to scan content before it is filed or sent to external APIs.
- [EXTERNAL_DOWNLOADS]: The skill references official repositories for tool dependencies, such as the GitHub CLI and OpenAI Codex CLI.
Audit Metadata