gstack-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the latest version of gstack from its official repository.
- Evidence:
git clone --depth 1 https://github.com/garrytan/gstack.git "$TMP_DIR/gstack"inSKILL.md. - Note: This targets a well-known project repository and is part of the core upgrade functionality.
- [REMOTE_CODE_EXECUTION]: The upgrade process involves executing a setup script included in the downloaded content.
- Evidence:
./setupis called after updating the git repository or cloning the vendored version inSKILL.md. - Note: Execution of a setup script is standard practice for tool installation and upgrades.
- [COMMAND_EXECUTION]: The skill uses various shell commands to detect environment state, manage files, and configure the tool.
- Evidence: Uses
git,mkdir,rm,mv,cp, and project-specific binaries likegstack-configandgstack-update-checkthroughoutSKILL.md. - Evidence: Writes configuration and state markers to
~/.gstack/and~/.claude/skills/gstack/.
Audit Metadata