submit-to-hackathon

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes bash scripts to manage telemetry configuration and perform project health checks.
  • Preamble and post-run bash blocks manage telemetry state in the ~/.superstack/ directory, using standard utilities like grep, sed, and date.
  • The skill recommends and executes CLI commands such as solana program show and git remote -v to verify that the user's project is correctly deployed and hosted on GitHub.
  • [DATA_EXFILTRATION]: The skill transmits anonymized usage metadata to a remote server.
  • Telemetry data including the skill name, execution status, platform architecture, and session duration is sent to a remote API endpoint via curl.
  • This behavior is governed by a mandatory user consent flow that allows users to opt-in or opt-out, and the destination URL is retrieved from a local configuration file (~/.superstack/config.json) rather than being hardcoded.
  • [DATA_EXPOSURE]: The skill reads local files to gather context for the hackathon submission.
  • It accesses .superstack/idea-context.md and .superstack/build-context.md to enrich the generated project descriptions. This is a primary function of the skill and is performed on project-specific data within the working directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 11:05 AM
Security Audit — agent-trust-hub — submit-to-hackathon