design-consultation
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill requires manual installation by cloning a repository (https://github.com/garrytan/gstack.git) and executing a local ./setup script. This pattern involves downloading and executing unverified code from an external source.
- [EXTERNAL_DOWNLOADS]: The installation process performs a shallow clone of a 98 MB repository and downloads the Chromium browser during the setup phase.
- [COMMAND_EXECUTION]: The skill provides shell commands for the agent to check installation status and performs its setup through a sequence of shell operations (git clone, cd, ./setup).
- [PERSISTENCE]: The setup script modifies the agent's environment by registering a 'Stop hook' in settings and instructing the agent to modify its project-level configuration file (CLAUDE.md).
- [DYNAMIC_EXECUTION]: The setup process includes building binaries from source using the Bun runtime, which involves compiling code provided in the external repository at install time.
Audit Metadata