Security audit

GStack Dev Workflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent development workflow, but its broad activation plus ship-phase git push/PR actions lack clear confirmation gates.

Install only if you want an agent to run an opinionated development workflow in your repositories. Before using Build, Test, or Ship, require the agent to show exact files, commands, branch, remote, and PR target, and confirm before commits, rebases, pushes, or overwriting DESIGN.md/PLAN.md.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrases are broad and overlap with common developer requests such as 'start a project', 'build a feature', and 'ship code', which increases the chance the skill is invoked when the user did not intend this workflow or its side effects. In this skill, accidental invocation is more dangerous because later phases include file writes, browser-driven actions, and git/PR operations, so overbroad activation can lead to unintended repository changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs writing repository-root files like DESIGN.md and PLAN.md without explicitly warning the user that local project files will be created or modified. In a development repository, silent file creation can overwrite expectations, pollute the workspace, or be chained into later automated steps that assume those files are authoritative.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The Ship phase includes git pull/rebase, test execution, push, and PR creation, all of which can modify local and remote repository state, yet the skill does not prominently warn or require explicit approval for those actions. This is especially risky because the skill is a generic workflow for normal development requests, so an unintentionally triggered or misunderstood run could publish code, alter branch history, or open external artifacts in the team's repository.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: This markdown prompt explicitly instructs the agent to create `DESIGN.md` in the project root, which modifies user files. The prompt does not include any warning, disclosure, or confirmation language to alert the user that repository files will be created or overwritten.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The prompt tells the agent to read `DESIGN.md` and output `PLAN.md` in the project root, which is a file write affecting the user's workspace. There is no accompanying warning that project files will be created or modified.

Static analysis

No suspicious patterns detected.