gstack-sprint
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands including
git rev-parse,git remote, andlsin Phase 3 to identify the repository context and locate specific design documentation files. - [DATA_EXFILTRATION]: Accesses the
~/.gstack/projects/directory to read design documents. This file access is limited to the tool's specific data storage path in the user's home directory. - [PROMPT_INJECTION]: The review phase (Phase 3) ingests external repository files and design documents, which acts as a surface for indirect prompt injection. * Ingestion points: Implementation files and design markdown documents read during Phase 3. * Boundary markers: No explicit delimiters or instructions are used to separate ingested content from the agent's internal logic. * Capability inventory: The skill can read local files, execute shell commands, and invoke other skills like
ralph. * Sanitization: There is no evidence of content validation or sanitization for the files processed during the review phase.
Audit Metadata