plan-tune

Warn

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill's preamble uses eval on the output of gstack-slug and source on the output of gstack-repo-mode. This executes shell code generated at runtime by binaries within the skill's directory.
  • [DATA_EXPOSURE]: The preamble accesses ~/.claude.json, which is the primary configuration file for the AI agent environment. It reads this file to determine MCP server types and transport modes.
  • [COMMAND_EXECUTION]: The skill makes extensive use of shell commands for state management (mkdir, rm, touch), Git operations (git branch, git add, git commit), and tool invocation (bun -e) across its preamble and various workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from learnings.jsonl and question-log.jsonl to provide context and review history.
  • Ingestion points: Files learnings.jsonl and question-log.jsonl in the ~/.gstack/ directory.
  • Boundary markers: None identified for the ingestion of historical logs.
  • Capability inventory: Uses Bash, Write, and Edit tools; preamble performs eval and source operations.
  • Sanitization: Uses bun to parse JSON data, providing structural validation but not content sanitization.
  • [EXTERNAL_DOWNLOADS]: The skill includes logic to synchronize an artifacts repository using git fetch and git merge if a remote source is detected. It also checks for updates via a local binary.
  • [DATA_EXFILTRATION]: The skill includes opt-in telemetry that sends usage data (skill name, duration, session ID) to an external service using the gstack-telemetry-log binary.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 26, 2026, 06:32 PM