context-restore

File write operations in the preamble (mkdir, touch) create persistent session tracking without explicit user disclosure. While the intent appears to be session management, users may not expect the skill to automatically create and maintain ~/.gstack/sessions directories and files on every invocation. This violates the principle of least surprise and informed consent for persistent state changes.

fix Add an AskUserQuestion in the skill workflow before the preamble runs (or immediately after) disclosing that the skill will create ~/.gstack/ session tracking directories. Offer users the choice to opt-in to session persistence, or move session file creation to explicit user-invoked operations rather than automatic preamble execution.

Multiple gstack-config set operations modify user configuration (checkpoint_mode, telemetry, explain_level, proactive, routing_declined) without requiring explicit user confirmation at the moment of change. Although these are preceded by AskUserQuestion prompts in some cases, the skill instructions allow silent writes to config if certain conditions are met (e.g., 'Always run' blocks that bypass confirmation).

fix Ensure every configuration write is immediately preceded by user confirmation via AskUserQuestion. Remove or refactor 'Always run' blocks that write config without consent. Log all config changes with timestamps for user auditability.

Telemetry logging writes to ~/.gstack/analytics/skill-usage.jsonl in the preamble without an explicit warning in the skill invocation itself. The warning appears only in a separate TEL_PROMPTED gate, which may not fire on every invocation. Users may not realize analytics data is being collected during skill execution.

fix Display a brief inline notice when this skill runs if telemetry is enabled: 'Analytics enabled: logging skill invocations to ~/.gstack/analytics/'. Alternatively, move telemetry writes outside the preamble and gate them behind an explicit user confirmation step.

Git operations (git rm -r, git add, git commit) are presented as part of an AskUserQuestion option but lack intermediate confirmation or a dry-run preview. If the user selects option A to migrate from vendored to team mode, multiple destructive git operations execute without allowing the user to review the changes before committing.

fix Before executing git operations, show the user what will be removed and committed via git status / git diff --cached. Require a second confirmation before running git commit. Alternatively, prepare the changes and ask 'Review the staged changes. Proceed with commit?' before executing the final git commit command.

The preamble executes multiple subprocess calls to gstack binaries (gstack-update-check, gstack-config, gstack-telemetry-log, gstack-learnings-search, etc.) without documenting what each binary does, what permissions it requires, or what data it accesses. If a gstack binary is compromised or malicious, this could silently execute arbitrary code on user machines.

fix Add inline comments documenting the purpose of each gstack binary call (e.g., '# gstack-config get proactive: checks if proactive skill suggestions are enabled'). Verify the integrity of gstack binaries via signed checksums in CI/CD. Consider requiring explicit user approval for any out-of-process binary execution that accesses sensitive data or modifies config.

GBrain and brain-sync operations access, query, and synchronize project artifacts (CEO plans, designs, reports) to a private GitHub repo without an explicit warning in the context-restore skill itself. Users may invoke /context-restore expecting only to read local saved context, not realizing it triggers brain-sync operations that push artifacts remotely.

fix Add a clear disclosure in the /context-restore workflow: 'Note: brain-sync will check for and upload artifacts to your configured GitHub repo. To skip this, run gstack-config set artifacts_sync_mode off before invoking this skill.' Require explicit opt-in before the first brain-sync operation in any session.

The instruction to log 'skill', 'ts', and 'repo' to skill-usage.jsonl without explicit per-invocation consent could violate privacy expectations. Even though telemetry is gated behind a TEL_PROMPTED guard, the skill is designed to collect and log data persistently across all future invocations once a user opts in, without the ability to refuse on a per-invocation basis.

fix Implement a per-invocation telemetry opt-out mechanism. Before collecting telemetry on any invocation, check if the user has explicitly disabled telemetry for this skill or session. Display 'Telemetry enabled. Disable for this session: gstack-config set telemetry off' at skill start. Alternatively, require users to re-confirm telemetry consent every N sessions (e.g., every 30 days).

The preamble uses a series of AskUserQuestion prompts (Lake Intro, Telemetry, Proactive Mode, Routing, Vendoring) that establish trust and normalize incremental behavior changes before requesting permission escalation (config writes, git operations, file system changes). This multi-step narrative can be psychologically effective at reducing user resistance to privilege escalation.

fix Separate the trust-building narrative from the permission escalation requests. For each behavior change (telemetry, proactive mode, vendoring migration), present the permissions required upfront in the ELI10 section. Use consistent, neutral framing across all prompts. Offer a 'Review all settings' option that shows all current config before accepting changes.

The skill is designed to persistently record and replay user session state across invocations via checkpoints, learnings, and timeline logs. While the intent is to improve user experience, the absence of a clear disclosure about what session state is being captured and retained could violate user expectations about privacy and data retention.

fix Add an explicit warning to the /context-restore skill description: 'This skill saves and restores your working context, including file paths, branch names, and task descriptions, to ~/.gstack/projects/. To review or delete saved context: gstack-context list --verbose.' Provide a clear 'Delete all checkpoints' command and default retention policy (e.g., 'Keep checkpoints for 30 days, then auto-delete').