stack
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it processes untrusted data from GitHub Pull Request titles and bodies.
- Ingestion points: External data is ingested through commands like
stack statusandstack syncwhich read PR metadata from GitHub. - Boundary markers: The skill uses deterministic boundary markers (
<!-- stack:links:start -->and<!-- stack:links:end -->) to isolate tool-generated content within PR descriptions. - Capability inventory: The skill allows for git branch modification (rebasing, cherry-picking) and PR updates (retargeting bases, updating descriptions) via the
stackCLI. - Sanitization: The skill mitigates risks by instructing the agent to verify the tool's help documentation, use dry-runs (
--dry-run), and obtain explicit user authorization for any mutating actions. - [COMMAND_EXECUTION]: The skill instructs the agent to execute a local CLI tool. It includes specific safety guidance to verify the tool's identity using
command -v stackand--helpto prevent the agent from accidentally interacting with unrelated executables that share the same name (e.g., the Haskell build tool).
Audit Metadata