review
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a runtime manifest and versioned artifacts from the vendor's official GitHub repository (github.com/time-attack/gstack). This is used to install optional local capabilities like browser automation and iOS testing support.
- [REMOTE_CODE_EXECUTION]: Downloads and executes a local installation script (install.js) contained within vendor-signed artifacts. The installation process includes SHA-256 integrity checks and supports Cosign attestation verification.
- [COMMAND_EXECUTION]: Executes various local development and security tools, including git, gh, glab, claude, and codex CLIs, as well as a local HTTP readiness server on 127.0.0.1 for browser testing.
- [PROMPT_INJECTION]: Implements defensive auditing phases that specifically scan for prompt injection and supply chain vulnerabilities in other AI agent skills.
- [SAFE]: Incorporates a canonical redaction engine (redact-patterns.ts) that identifies and masks secrets, PII, and internal metadata, ensuring sensitive information is protected during analysis and multi-agent reviews.
Audit Metadata