context-restore
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses extensive Bash scripting and git commands to manage session metadata, project slugs, and repository state. It executes several local binaries within the
~/.claude/skills/gstack/bin/directory and utilizesevalandsourcewith these binaries to initialize the environment. - [EXTERNAL_DOWNLOADS]: Includes a mechanism to check for framework updates via a local utility and provides an option to open an informational URL (
garryslist.org) in the browser. These network-related activities are restricted to the developer's verified infrastructure. - [DATA_EXFILTRATION]: Contains an optional telemetry system for reporting usage statistics (skill name, duration, outcomes). The skill explicitly prompts the user for consent before enabling this feature and provides granular options for anonymous reporting or disabling it entirely.
- [PROMPT_INJECTION]: The skill reads and summarizes user-generated checkpoint files from
~/.gstack/projects/$SLUG/checkpoints/(SKILL.md). These ingestion points lack explicit boundary markers or sanitization, creating a potential surface for instructions embedded in previously saved contexts to influence the agent's behavior during restoration.
Audit Metadata