submit-to-hackathon
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes bash scripts to manage telemetry configuration and perform project health checks.
- Preamble and post-run bash blocks manage telemetry state in the
~/.superstack/directory, using standard utilities likegrep,sed, anddate. - The skill recommends and executes CLI commands such as
solana program showandgit remote -vto verify that the user's project is correctly deployed and hosted on GitHub. - [DATA_EXFILTRATION]: The skill transmits anonymized usage metadata to a remote server.
- Telemetry data including the skill name, execution status, platform architecture, and session duration is sent to a remote API endpoint via
curl. - This behavior is governed by a mandatory user consent flow that allows users to opt-in or opt-out, and the destination URL is retrieved from a local configuration file (
~/.superstack/config.json) rather than being hardcoded. - [DATA_EXPOSURE]: The skill reads local files to gather context for the hackathon submission.
- It accesses
.superstack/idea-context.mdand.superstack/build-context.mdto enrich the generated project descriptions. This is a primary function of the skill and is performed on project-specific data within the working directory.
Audit Metadata