skills/time-attack/gstack/design/Gen Agent Trust Hub

design

Pass

Audited by Gen Agent Trust Hub on Jul 22, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The runtime-bootstrap.mjs script fetches a runtime manifest and component archives from the vendor's official GitHub releases at github.com/time-attack/gstack.
  • [REMOTE_CODE_EXECUTION]: The skill's bootstrap process executes an installer script (install.js) included within the downloaded components to set up optional runtime capabilities. This procedure is gated by a mandatory user consent flag (--yes) and incorporates integrity checks.
  • [COMMAND_EXECUTION]: The skill invokes various system commands (git, ls, cat) for environment discovery and manages the execution of its own specialized tool suite, including browse, gstack-design, and make-pdf.
  • [EXTERNAL_DOWNLOADS]: The HTML implementation module fetches the pretext layout library from esm.sh, a well-known CDN, when a local asset is not present.
  • [COMMAND_EXECUTION]: The design review module offers to set up test infrastructure by installing standard community-trusted packages (such as vitest, rspec, or pytest) via official package managers based on user preference.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 22, 2026, 08:20 PM
Security Audit — agent-trust-hub — design