gsd-agents
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Multiple agent role definitions (such as 'gsd-advisor-researcher' and 'gsd-ai-researcher') instruct the agent to run 'npx --yes ctx7@latest' as a fallback when documentation tools are unavailable. This practice downloads and executes remote code from the npm registry without version pinning or manual verification.
- [REMOTE_CODE_EXECUTION]: The 'gsd-phase-researcher' role includes a process that automatically attempts to install the 'slopcheck' Python package using 'pip' at runtime.
- [EXTERNAL_DOWNLOADS]: The skill requires downloading and running third-party tools ('ctx7', 'slopcheck') that are not recognized as well-known or trusted services. Notably, the skill's own 'gsd-executor' role contains a security warning against using 'npx --yes', while other roles within the same skill package explicitly direct the agent to use it.
- [COMMAND_EXECUTION]: Roles such as 'gsd-executor' and 'gsd-code-fixer' are designed to perform complex shell command execution and filesystem modifications based on AI-generated plans or reviews. This represents a broad attack surface if the agent's input is subverted by malicious documentation or project files.
- [PROMPT_INJECTION]: The skill's instructions require agents to treat local repository files like 'CLAUDE.md' and 'CONTEXT.md' as 'hard constraints' or 'locked decisions'. This creates a significant risk of indirect prompt injection where an attacker could influence the agent's behavior by modifying these project files.
Audit Metadata