landing-report
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple local binaries including gstack-config, gstack-slug, and gstack-timeline-log to collect repository status and session data.
- [DYNAMIC_EXECUTION]: Uses eval and source commands for dynamic initialization of environment variables and operational modes from local script outputs.
- [EXTERNAL_DOWNLOADS]: Facilitates artifact synchronization and update checks via dedicated binaries, which involve interactions with remote repositories such as GitHub.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources and local files to populate its dashboard. 1. Ingestion points: VERSION file, git branch output, and GitHub PR metadata. 2. Boundary markers: Absent in the bash scripts. 3. Capability inventory: Bash execution, Git/GitHub CLI operations, and file read/write access. 4. Sanitization: Uses jq to extract specific fields and format the dashboard output.
- [PERSISTENCE]: Configures project-specific routing by appending instructions to the project's CLAUDE.md file, which influences AI agent behavior in future sessions.
Audit Metadata