ship
Warn
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the 'Bash' tool to execute local utility binaries and scripts (e.g.,
gstack-update-check,gstack-config,gstack-telemetry-log,gstack-slug) located in the~/.claude/skills/gstack/bin/directory to manage configuration, sessions, and telemetry. - [EXTERNAL_DOWNLOADS]: Features a self-update mechanism that checks for new versions and follows an 'Inline upgrade flow' to update skill files. It also dynamically installs developer tools and test frameworks from public registries (NPM, PyPI, RubyGems) during its 'Test Framework Bootstrap' phase.
- [DATA_EXFILTRATION]: Collects and sends telemetry data (usage metrics, outcomes, durations) to an external logging service. Additionally, it transmits codebase diffs to an external AI service (OpenAI Codex) to perform structural and adversarial code reviews.
- [REMOTE_CODE_EXECUTION]: The 'Inline upgrade flow' and the execution of external CLI tools like
codexpresent potential vectors for remote code execution if the vendor infrastructure or the third-party binaries are compromised. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) as it processes untrusted data from the codebase (via
git diff) and is instructed to perform automated actions like committing code and pushing to remote repositories without explicit user confirmation for every intermediate step.
Audit Metadata