cc-stack-setup
Warn
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill's detection logic in detection-matrices.md scans for sensitive strings inside .env files, specifically looking for DATABASE_URL, STRIPE, SENTRY, and SLACK keys to determine project configuration.
- [DATA_EXFILTRATION]: SKILL.md contains a hardcoded absolute file path C:/Users/MarkusAhling/obsidian/ used as a detection signal for an Obsidian vault, which targets a specific local user directory and exposes personal environmental details.
- [COMMAND_EXECUTION]: The skill generates and installs shell scripts into the .claude/hooks/ directory, which are intended to run automatically on lifecycle events, establishing a mechanism for persistent code execution.
- [PROMPT_INJECTION]: The skill ingests untrusted repository data (e.g., package.json, docker-compose.yml, and environment files) to drive its setup workflow, creating a surface for indirect prompt injection where malicious repository content could influence generated configurations. 1. Ingestion points: Repository configuration files listed in detection-matrices.md. 2. Boundary markers: None identified in the instruction set to isolate untrusted repo data from the agent's logic. 3. Capability inventory: File writing (.claude/), tool invocation (cc_kb_* tools), and shell script generation. 4. Sanitization: No explicit sanitization or validation of the ingested file content before it is used to generate configuration artifacts.
Audit Metadata