design
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
runtime-bootstrap.mjsscript fetches a runtime manifest and component archives from the vendor's official GitHub releases atgithub.com/time-attack/gstack. - [REMOTE_CODE_EXECUTION]: The skill's bootstrap process executes an installer script (
install.js) included within the downloaded components to set up optional runtime capabilities. This procedure is gated by a mandatory user consent flag (--yes) and incorporates integrity checks. - [COMMAND_EXECUTION]: The skill invokes various system commands (
git,ls,cat) for environment discovery and manages the execution of its own specialized tool suite, includingbrowse,gstack-design, andmake-pdf. - [EXTERNAL_DOWNLOADS]: The HTML implementation module fetches the
pretextlayout library fromesm.sh, a well-known CDN, when a local asset is not present. - [COMMAND_EXECUTION]: The design review module offers to set up test infrastructure by installing standard community-trusted packages (such as
vitest,rspec, orpytest) via official package managers based on user preference.
Audit Metadata