review
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several local vendor binaries (e.g., gstack-update-check, gstack-config, gstack-telemetry-log) located in the user's home directory (~/.claude/skills/gstack/bin/) to manage updates, configurations, and logging.
- [DATA_EXFILTRATION]: The skill collects and transmits usage telemetry (skill name, execution duration, and outcome) to the vendor's infrastructure. This behavior is transparent, including a dedicated user prompt for consent that offers Community, Anonymous, or Off modes.
- [PROMPT_INJECTION]: The skill ingests untrusted content from the repository (e.g., git diff output, TODOS.md) and GitHub metadata (PR descriptions). This data is used to drive automated reviews and is passed to an adversarial subagent without explicit boundary markers or input sanitization.
- Ingestion points: git diff output, TODOS.md file, and PR descriptions fetched via the gh command.
- Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore instructions embedded within the ingested text.
- Capability inventory: The skill has access to Bash, Read, Edit, Write, Grep, Glob, and Agent tools.
- Sanitization: No sanitization or validation of the untrusted text is performed before it is processed by the primary agent or dispatched to the subagent.
Audit Metadata