heating the forge...

@forgecat/garrytan_gstack — Security Risk Report | ForgeCat

garrytan_gstack

Security risk report for @forgecat/garrytan_gstack v0.0.10

SRC-010High

Static scanner flagged danger level: profile references external repositories, build artifacts, or third-party code without clear provenance or integrity verification.
Evidence: README.md and CLAUDE.md reference the original gstack repository (github.com/garrytan/gstack), npm/Bun package dependencies, external fonts (Fontshare CDN, Google Fonts), and compiled binaries (browse/dist/browse ~58MB).
The profile is a legitimate open-source project with documented dependencies and clear attribution to Garry Tan, but the supply-chain risk stems from reliance on external build tooling (Bun, Playwright, Chromium), third-party CDN fonts, and pre-compiled binaries without embedded checksums or signature verification in the profile itself.

Details

Findings

Suspicious URLs
skills/garrytan_gstack/CHANGELOG.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/design-consultation/SKILL.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/design-shotgun/SKILL.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/docs/howto-ios-testing-with-gstack.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/ios-qa/SKILL.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/office-hours/SKILL.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/plan-design-review/SKILL.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/docs/designs/CONDUCTOR_SESSION_API.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/docs/designs/DESIGN_SHOTGUN.md · SKILL-007
Suspicious URLs
skills/garrytan_gstack/extension/background.js · SKILL-007
Suspicious URLs
skills/garrytan_gstack/extension/sidepanel-terminal.js · SKILL-007
Suspicious URLs
skills/garrytan_gstack/extension/sidepanel.js · SKILL-007
Credential-to-network dataflow
skills/garrytan_gstack/bin/gstack-global-discover.ts · SKILL-010
Credential-to-network dataflow
skills/garrytan_gstack/bin/gstack-memory-ingest.ts · SKILL-010

Low

No instructions to manipulate the AI, ignore system prompts, exfiltrate credentials, or hide instructions.
Content is technical documentation describing a legitimate software engineering workflow tool—skills, browser automation, deployment pipelines, and security auditing (OWASP/STRIDE).
The profile documents security practices (prompt-injection defense layers, token scoping, dual-listener tunnel architecture, CSO security audit skill) rather than instructing the agent to weaken them.

Details

Findings

Prompt injection
skills/garrytan_gstack/CHANGELOG.md · SKILL-006
Invisible characters detected
skills/garrytan_gstack/CHANGELOG.md · SKILL-011
Invisible characters detected
skills/garrytan_gstack/autoplan/SKILL.md · SKILL-011
Invisible characters detected
skills/garrytan_gstack/design-review/SKILL.md · SKILL-011
Invisible characters detected
skills/garrytan_gstack/document-release/SKILL.md · SKILL-011

Low

Skills are described as specialized roles (review, QA, design, deployment, iOS testing) with authority scoped to their stated function.
Browser automation (browse, scrape, qa, design-review) and file operations (document-generate, ship, land-and-deploy) are appropriate to the stated workflow purpose.
Safety skills (careful, freeze, guard) explicitly restrict destructive operations and require confirmation; no alwaysApply=true rules with unrestricted globs detected.

Details

Evidence

AGENTS.md lists skills with clear purpose statements: '/qa — Systematically QA test a web application and fix bugs found', '/ship — Run tests, review, push, open PR'.
CONTRIBUTING.md documents operational learnings and session awareness to prevent accidental destructive commands.
BROWSER.md describes token-scoped access control: tunnel listener restricts root token to 404, allows scoped tokens only for a 26-command allowlist.

Low

No MCP servers are declared in the profile.
The profile uses a compiled Bun binary (browse/dist/browse) for browser automation, not an MCP server definition.
Architecture relies on localhost HTTP communication with token-based authentication and port randomization, not arbitrary binary execution or unrestricted network access.

Details

Evidence

Profile metadata states '(none)' for MCP servers.
ARCHITECTURE.md describes the daemon model: HTTP server on random port 10000–60000, Bearer token auth, localhost-only binding (127.0.0.1).
BROWSER.md documents dual-listener tunnel architecture with physical port separation and scoped token allowlists for remote agent access.