Security audit

GStack Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent software-factory assistant, but it can edit code, push or merge changes, and deploy from broad prompts without clear approval checkpoints.

Review carefully before installing. Use it only in repositories where the agent may write files and possibly use Git or deployment credentials. Prefer explicit slash commands, use `/qa-only` for report-only testing, enable `/guard` or `/freeze` for sensitive work, and require manual approval before edits, rebases, pushes, PR merges, deployments, or production reverts.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill advertises very broad natural-language triggers such as product review, code review, QA, deployment, and documentation requests without requiring an explicit command prefix or confirmation step. In an agentic environment, this can cause unintended activation of powerful workflows that may inspect code, run tools, or modify repositories based on ordinary conversation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Many role descriptions define activation in vague conversational terms instead of strict eligibility criteria. This ambiguity increases the chance that the wrong role will be invoked, which is especially risky here because several roles can edit code, run tests, push branches, or deploy changes.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The code review role can be triggered by highly generic phrases like '审查我的代码' or '帮我 review' and is documented to automatically fix issues. This creates a realistic path from casual conversation to unapproved code modification, making accidental or manipulated invocation more dangerous.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The QA role is triggered by broad phrases like '帮我测试' or '有没有 bug' but its workflow includes execution and automatic remediation. Because the trigger does not distinguish between asking for an opinion and authorizing active testing and code changes, the skill can overreach user intent.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The deployment-related role overlaps with common release conversation and can lead to merge and deployment actions. In this context, ambiguous activation is more dangerous than usual because a mistaken trigger can affect production systems, repositories, or CI/CD state.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The review workflow states that it will automatically repair P0 and some P1 issues, but the description does not prominently warn users that invoking review may modify code. This undermines informed consent and can lead to unauthorized or surprising source changes during what sounds like a diagnostic activity.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The QA flow includes discovering defects and automatically submitting fixes, but the user-facing description does not emphasize that code changes may occur as part of testing. This is risky because testing is commonly understood as observational, not mutating, so users may trigger edits unintentionally.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The release preparation workflow includes rebasing, running tests, adding tests, pushing branches, and creating a PR, all of which can materially change repository state and remote collaboration surfaces. The absence of prominent risk disclosure and approval checkpoints makes unintended source-control actions more likely.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This workflow can merge to main, trigger deployment, perform production smoke tests, and revert changes, but it lacks a strong user-facing risk notice and approval sequence. In a software-factory skill with deployment authority, insufficient friction around production changes can directly cause outages, unauthorized releases, or irreversible operational impact.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The documentation update workflow can rewrite multiple project documents in bulk, but the skill does not clearly warn users about the breadth of file modifications. While lower impact than deployment, it can still create unwanted repository churn, overwrite curated documentation, or mask unintended changes.

Static analysis

No suspicious patterns detected.