diagram
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses extensive shell commands in the preamble to manage sessions, check for updates, and handle local configuration within the user's home directory (e.g.,
~/.gstack/and~/.claude/skills/gstack/). These commands are primarily used for environment setup and lifecycle management. - [DYNAMIC_EXECUTION]: The skill employs
evalandsourcewith process substitution to dynamically load environment variables and repository modes from local binaries such asgstack-slugandgstack-repo-mode. This is a common pattern for integrating complex skill logic with the agent's shell environment. - [DATA_EXFILTRATION]: The skill contains logic for telemetry logging and 'Artifacts Sync'. Telemetry captures usage data such as skill duration and crashes, while the sync feature publishes artifacts to a private GitHub repository. Notably, these features are explicitly gated by user consent through
AskUserQuestionprompts, and telemetry can be opted out of entirely. - [EXTERNAL_DOWNLOADS]: Performs
git fetchandgit mergeoperations to synchronize project artifacts between machines if the user opts into the Artifacts Sync feature. It also includes an update check mechanism that identifies if new versions of the skill components are available.
Audit Metadata