registry / @indigoai-us/hq-pack-gstack / 1.1.2

@indigoai-us/hq-pack-gstack@1.1.2

HQ content pack: gstack-team workers (26 g-* skills) + scripts/gstack-bridge.sh

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs scripts/gstack-bridge.sh install, remove, or update.

Impact

A user-authorized command can alter available AI-agent skills from a separately cloned repository.

Mechanism

explicit agent-skill materialization and git-based update

Rationale

No concrete malicious behavior was found, but the package intentionally provides an explicit command that mutates an AI-agent skill control surface and can import updated external content. Policy classifies this as warn-level capability risk.

Evidence

package.jsonpackage.yamlscripts/gstack-bridge.shworkers/gstack-team/worker.yaml${HQ_ROOT}/.claude/skills/g-*${HQ_ROOT}/repos/public/gstack

Network endpoints1

github.com/garrytan/gstack

Decision evidence

public snapshot

AI called this at 91.0% confidence with false-positive risk.

@indigoai-us/hq-pack-gstack@1.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code