gstack-sprint

Pass

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands including git rev-parse, git remote, and ls in Phase 3 to identify the repository context and locate specific design documentation files.
  • [DATA_EXFILTRATION]: Accesses the ~/.gstack/projects/ directory to read design documents. This file access is limited to the tool's specific data storage path in the user's home directory.
  • [PROMPT_INJECTION]: The review phase (Phase 3) ingests external repository files and design documents, which acts as a surface for indirect prompt injection. * Ingestion points: Implementation files and design markdown documents read during Phase 3. * Boundary markers: No explicit delimiters or instructions are used to separate ingested content from the agent's internal logic. * Capability inventory: The skill can read local files, execute shell commands, and invoke other skills like ralph. * Sanitization: There is no evidence of content validation or sanitization for the files processed during the review phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 25, 2026, 08:09 PM
Security Audit — agent-trust-hub — gstack-sprint