skills/open-gsd/gsd-path/path/Gen Agent Trust Hub

path

Warn

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill implements a runtime selection mechanism in scripts/status_runtime.py that uses compile() and exec() to run Python scripts from a project-local directory (.gsd-path/runtime).
  • This allows the skill to execute code that is not part of the static skill bundle.
  • While it performs digest verification against a manifest.json, the execution of project-local code remains a significant security boundary crossing.
  • [DATA_EXFILTRATION]: The script scripts/jev_review.py is designed to send success criteria and evidence (which may include product code and internal documentation) to an external API at api.typesafe.ai for screening.
  • This behavior is optional and requires the GSD_PATH_JEV environment variable to be enabled by the user.
  • It utilizes an API key (TYPESAFE_API_KEY) provided via the environment.
  • [COMMAND_EXECUTION]: The skill relies extensively on subprocess.run() for Git operations and workflow orchestration.
  • scripts/dispatch_driver.py facilitates the execution of arbitrary commands provided as child-command arguments to launch sub-agents for building and reviewing tasks.
  • scripts/loop_run.py executes shell commands defined in LOOP.md for continuous verification and repair cycles.
  • [EXTERNAL_DOWNLOADS]: scripts/check_update.py makes network requests to the npm registry (registry.npmjs.org) to check for newer versions of the GSD Path package.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a large ingestion surface, reading various Markdown artifacts (TASK.md, INTENT.md, SYNTHESIS.md) and product code which is then passed to sub-agents.
  • Ingestion points: Files are read in scripts/check_handoffs.py, scripts/isolation.py, and scripts/build_state.py.
  • Boundary markers: Uses Markdown templates with fenced code blocks to delineate instructions from data.
  • Capability inventory: Extensive use of subprocess and the ability to spawn new agent contexts via dispatch_driver.py.
  • Sanitization: Relies primarily on the model following complex role-based instructions and structural validators.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 29, 2026, 04:41 PM