skills/garrytan/gstack/sync-gbrain/Gen Agent Trust Hub

sync-gbrain

Pass

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses eval and source <(...) patterns in its preamble to execute shell code generated by local helper binaries such as gstack-slug and gstack-repo-mode. This allows for dynamic environment configuration but involves executing computed output.
  • [COMMAND_EXECUTION]: Extensive use of shell commands (bash, bun, find, git, grep) for session management, state probing, and orchestrating the gbrain sync process.
  • [EXTERNAL_DOWNLOADS]: The skill includes an update check mechanism (gstack-update-check) and provides options to download/view documentation from external domains like garryslist.org.
  • [DATA_EXFILTRATION]: Contains built-in telemetry features that collect and send usage data (skill name, duration, outcome, and session IDs) to external endpoints. While the skill includes an opt-in/opt-out mechanism for this behavior, it represents an active data transmission channel.
  • [DATA_EXFILTRATION]: Includes an 'Artifacts Sync' feature that can publish project artifacts (plans, designs, reports) to a remote GitHub repository. This functionality is intended for cross-machine synchronization but involves transferring local project data to a remote service.
  • [PROMPT_INJECTION]: The skill is designed to automatically modify the project's CLAUDE.md file to inject 'Skill routing' rules and 'Search Guidance'. This capability allows the skill to programmatically influence the agent's future instructions and behavior based on project content.
  • [PROMPT_INJECTION]: The preamble contains logic that explicitly instructs the agent to treat the skill file as 'executable instructions, not reference' and to prioritize skill workflows over generic model behavior, which is a pattern commonly associated with overriding system constraints.
Audit Metadata
Risk Level
SAFE
Analyzed
May 10, 2026, 12:18 PM