setup-pstack

Warn

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes external command-line utilities to verify credentials and model availability.\n
  • Evidence: Calls claude auth status --json, codex login status, and grok models to verify model lanes.\n
  • Evidence: Utilizes codex exec and Grok CLI to perform connectivity probes.\n- [PERSISTENCE]: The skill modifies system-level instruction files that govern agent behavior across multiple sessions.\n
  • Evidence: Appends an include directive (@~/.claude/pstack-models.md) to ~/.claude/CLAUDE.md, which is a configuration file loaded during agent initialization.\n
  • Evidence: Inserts a configuration block between markers in ~/.codex/AGENTS.md to persist model assignments.\n- [DYNAMIC_EXECUTION]: The skill spawns child agents and manages background processes during its verification phase.\n
  • Evidence: Launches "Claude-native agents" (e.g., pstack-fable-high) as one-turn probes.\n
  • Evidence: Executes spawn_agent in the Codex environment to test reasoning efforts.\n
  • Evidence: Launches external processes in the background with retained handles to verify multi-lane connectivity.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data to generate instruction sets, creating a potential vector for indirect influence.\n
  • Ingestion points: Reads the model matrix and descriptor grammar from provider-dispatch.md and existing sheet files in home directories.\n
  • Boundary markers: Uses XML-style comments (<!-- pstack:models:begin -->) in Codex configuration files, but these serve as delimiters rather than security sanitization.\n
  • Capability inventory: Can write to persistent instruction files and execute CLI commands or child agents based on the parsed configuration.\n
  • Sanitization: Mentions normalization of specific rolling-alias model names, but lacks generic sanitization or escaping of the parsed content before it is written into system-level instruction files.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 9, 2026, 04:36 AM