gstack-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the latest version of gstack from its official repository.
  • Evidence: git clone --depth 1 https://github.com/garrytan/gstack.git "$TMP_DIR/gstack" in SKILL.md.
  • Note: This targets a well-known project repository and is part of the core upgrade functionality.
  • [REMOTE_CODE_EXECUTION]: The upgrade process involves executing a setup script included in the downloaded content.
  • Evidence: ./setup is called after updating the git repository or cloning the vendored version in SKILL.md.
  • Note: Execution of a setup script is standard practice for tool installation and upgrades.
  • [COMMAND_EXECUTION]: The skill uses various shell commands to detect environment state, manage files, and configure the tool.
  • Evidence: Uses git, mkdir, rm, mv, cp, and project-specific binaries like gstack-config and gstack-update-check throughout SKILL.md.
  • Evidence: Writes configuration and state markers to ~/.gstack/ and ~/.claude/skills/gstack/.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 05:26 AM