heating the forge...

@forgecat/garrytan_gstack — Security Risk Report | ForgeCat

garrytan_gstack

Security risk report for @forgecat/garrytan_gstack v0.0.12

SRC-003High

Static scanner assigned level=high, reflecting that the profile bundles or references a large number of external runtime artifacts (40+ workflow files across 5 platforms) sourced from a private GitHub repository at a pinned commit.
The profile explicitly downloads binaries (renderer, Chromium, impeccable engine) from external URLs, with integrity verified only by size and SHA-256 pinned in source files — supply chain trust depends entirely on the integrity of those pinned values.
The `NOTICE.md` acknowledges derived/modified code from Apache-2.0 works (impeccable, DESIGN.md spec by Google LLC), and the scanner flagged numerous `refs/` paths as tool-source hints, indicating significant third-party code incorporation whose provenance cannot be fully verified from the profile alone.

Details

Findings

refs/gstack-runtime/careful/bin/check-careful.sh:89
Suspicious URLs
refs/gstack-runtime/design-shotgun/SKILL.source.md · SKILL-007
Code obfuscation
refs/gstack-runtime/diagram/SKILL.source.md · SKILL-005
Suspicious URLs
refs/gstack-runtime/docs/howto-ios-testing-with-gstack.md · SKILL-007
Suspicious URLs
refs/gstack-runtime/gstack-upgrade/SKILL.source.md · SKILL-007
Suspicious URLs
refs/gstack-runtime/ios-qa/SKILL.source.md · SKILL-007
Suspicious URLs
refs/gstack-runtime/office-hours/SKILL.source.md · SKILL-007
Suspicious URLs
refs/gstack-runtime/plan-design-review/SKILL.source.md · SKILL-007
Suspicious URLs
refs/gstack-runtime/design-consultation/sections/proposal-and-preview.md · SKILL-007
Suspicious URLs
refs/gstack-workflows/claude-code/design-shotgun/workflow.md · SKILL-007
Code obfuscation
refs/gstack-workflows/claude-code/diagram/workflow.md · SKILL-005
Suspicious URLs
refs/gstack-workflows/claude-code/gstack-upgrade/workflow.md · SKILL-007
Suspicious URLs
refs/gstack-workflows/claude-code/ios-qa/workflow.md · SKILL-007
Suspicious URLs
refs/gstack-workflows/claude-code/office-hours/workflow.md · SKILL-007

INT-000Medium

The profile instructs the agent to execute a Python script (`scripts/entry.py`) by absolute path and follow a 'returned runtime contract' — the actual behavioral instructions are deferred to runtime-fetched content not visible in this review, creating an indirection risk where malicious instructions could be injected at runtime.
The setup flow instructs downloading and executing external binaries (Chromium, impeccable engine binary from GitHub releases, renderer) after user consent — while consent gates are described, the agent is directed to fetch and run remote code, which is a medium-risk pattern.
No direct credential exfiltration, role hijacking, or 'ignore previous instructions' language is present in the visible content; the profile's stated consent and permission-boundary language is consistent with legitimate tooling, keeping this at medium rather than high.

Details

Findings

Invisible characters detected
refs/gstack-runtime/autoplan/SKILL.source.md · SKILL-011
Invisible characters detected
refs/gstack-runtime/design-review/SKILL.source.md · SKILL-011
Invisible characters detected

PRM-000Medium

The profile spans 55 workflow families including shell execution (`python3 scripts/entry.py`), browser automation (Chromium/Aside), native plugin installation via host plugin managers, subagent spawning (`sessions_spawn`, `delegate_task`), and file system operations — collectively broader than any single stated purpose.
Skills like `careful`, `guard`, `freeze`, `cso`, `ios-fix`, and `land-and-deploy` imply write/mutate/deploy authority; the runtime contract explicitly discusses commits, pushes, PRs, and deployments, though it states these require explicit authorization.
No declared tools or MCP servers are present in the normalized tool list, so excessive agency manifests through prose-instructed shell and native-plugin calls rather than formal tool declarations — making scope harder to audit.

Details

Evidence

"native-install installs and enables the local plugin through the host manager" (runtime-contract.md)
"None of these helpers authorizes commits, pushes, PRs, deployments or messages on its own." (runtime-contract.md — disclaimer present but scope is still very broad)
"OpenClaw uses an isolated one-shot sessions_spawn; Hermes uses a fresh delegate_task leaf" (runtime-contract.md)

Low

No MCP servers are declared in this profile.
No tool definitions with hidden instructions, arbitrary binary execution via MCP, or unrestricted network/filesystem access through MCP are present.
Risk from external binary downloads and shell execution exists but is mediated through prose instructions rather than MCP server definitions.

Details

Evidence