plan-devex-review
“Interactive developer experience plan review. (gstack)”
aipkg.jsondx-hall-of-fame.mdLICENSE.txtREADME.mdSKILL.mdSKILL.md.tmpl- 01SDI-185%MEDIUM
SKILL.md:2006
detailhide
The skill is advertised as an interactive DX review tool, but executes extensive system configuration, telemetry collection, session tracking, and behavioral instrumentation unrelated to DX analysis. This scope creep violates principle of least surprise and creates hidden side effects the user did not consent to. A developer invoking this skill to review a product's developer experience gets a bundle of undisclosed system modifications instead.
2004file you are allowed to edit in plan mode. The plan file review report is part of the2005plan's living status.20062007The report must always be the LAST section of the plan file — never mid-file.2008Use a single delete-then-append flow:fix Separate system bootstrap logic from the DX review workflow. Move telemetry, session management, feature discovery, and config mutations into a dedicated preamble-only skill (e.g., /gstack-init) that runs once per session, not on every skill invocation. The DX review skill should focus exclusively on analysis and plan updates.
- 02SDI-280%MEDIUM
SKILL.md:2072
detailhide
The skill writes telemetry data, mutates user config settings (~/.gstack/config), creates session state files, and modifies project settings without explicit user approval for each action. This violates informed consent—a developer expecting a read-only review gets a tool that silently persists behavioral tracking and changes their environment.
2070measure against.20712072Use AskUserQuestion with applicable options:2073- **A)** Run /plan-eng-review next (required gate)2074- **B)** Run /plan-design-review (only if UI scope detected)fix Require explicit opt-in for any config mutation or telemetry write. Gate each mutation behind an AskUserQuestion. If the user is in a spawned session (SPAWNED_SESSION=true), skip all config mutations and telemetry writes—the orchestrator controls that. Document all side effects in the skill description.
- 03SDI-390%HIGH
SKILL.md:2008
detailhide
The manifest declares no permissions, yet the code reads/writes extensively outside the repository (~/.gstack/*, ~/.claude/*, ~/.gstack-brain*, /tmp/) and executes external binaries (gstack-* tools, git, curl, jq) without declared capability scope. This is a contract violation—the host cannot audit what the skill actually does, and a user cannot see the true footprint before invoking it. An attacker could modify ~/.claude/skills/gstack/bin/gstack-config or similar binaries to inject malicious behavior.
20062007The report must always be the LAST section of the plan file — never mid-file.2008Use a single delete-then-append flow:200920101. Read the plan file (Read tool) to see its full current content. Search the readfix Declare all permissions in the manifest: filesystem read/write scope (e.g., 'read: [~/.gstack/*, ~/.claude/], write: [~/.gstack/analytics/*]'), external binary execution scope (e.g., 'exec: [git, jq, curl]'), and environment variable access (e.g., 'env: [GSTACK_HOME, GSTACK_PLAN_MODE]'). Move undeclared binaries into a declared, versioned bin/ directory with integrity validation (checksums or signatures).
- 04SDI-475%MEDIUM
SKILL.md:0
detailhide
The skill's docstring (L0795-L0808) claims it is a pure DX review tool ('Interactive developer experience plan review'), but the code sections (L0921+, L1138-L1690) include auto-generating design docs, invoking other skills (/office-hours), and performing multi-phase plan modification. This is scope creep disguised as a single feature. A user invoking /plan-devex-review expecting a review gets a workflow that can spawn child skills and modify plans without warning.
fix Rename the skill to reflect its true scope, e.g., /autoplan-devex (auto-planning for DX). If the design doc auto-generation is essential, describe it in the manifest with honest expected runtime and side effects. If invoking /office-hours is optional, gate it behind a prominent AskUserQuestion early in the skill, not buried in prerequisite logic.
- 05SQP-285%MEDIUM
SKILL.md:40
detailhide
The preamble bash script modifies ~/.gstack/ without user disclosure or confirmation. It creates directories, writes JSONL logs, touches marker files, and executes external binaries silently. A user reading the skill description sees 'Interactive developer experience plan review' but does not see 'will write to ~/.gstack/analytics/, ~/.gstack/sessions/, and execute ~/.claude/skills/gstack/bin/* binaries'. This violates transparency.
38## Preamble (run first)3940```bash41_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)42[ -n "$_UPD" ] && echo "$_UPD" || truefix Add a disclosure section to the skill description listing all side effects: 'This skill writes to ~/.gstack/analytics/, creates session markers in ~/.gstack/sessions/, and calls gstack command-line tools. No data leaves your machine unless telemetry is enabled (opt-in). You can disable with gstack-config set telemetry off.' Gate the preamble execution behind an AskUserQuestion on first run, or skip it in spawned sessions (SPAWNED_SESSION=true).
- 06SQP-280%MEDIUM
SKILL.md:60
detailhide
Telemetry data collection (skill name, timestamp, repo name, duration) happens without explicit disclosure in the skill description. While the preamble includes logic to check telemetry config, a new user sees no warning that this skill collects ANY telemetry. The config default is 'true' (community mode), meaning telemetry is ON by default.
58_LAKE_SEEN=$([ -f ~/.gstack/.completeness-intro-seen ] && echo "yes" || echo "no")59echo "LAKE_INTRO: $_LAKE_SEEN"60_TEL=$(~/.claude/skills/gstack/bin/gstack-config get telemetry 2>/dev/null || true)61_TEL_PROMPTED=$([ -f ~/.gstack/.telemetry-prompted ] && echo "yes" || echo "no")62_TEL_START=$(date +%s)fix Explicitly state in the skill description: 'Telemetry: This skill logs skill name, duration, and outcome to ~/.gstack/analytics/ (local only, no remote transmission unless you opt-in to community telemetry). Disable with gstack-config set telemetry off.' Change the default to 'off' (telemetry disabled by default) so users opt-in rather than opt-out.
- 07SQP-280%MEDIUM
SKILL.md:40
detailhide
File system operations (mkdir, touch, find, rm) and state modifications (writing to ~/.gstack/*, creating CLAUDE.md sections, appending to .gitignore) happen without user warning in the skill description or prominent AskUserQuestion. A developer expecting a review tool gets a system modifier.
38## Preamble (run first)3940```bash41_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)42[ -n "$_UPD" ] && echo "$_UPD" || truefix Add a 'System Modifications' section to the skill description explicitly listing all files written: ~/.gstack/analytics/*, ~/.gstack/sessions/*, CLAUDE.md (skill routing section), .gitignore (vendored gstack), plan file (review report). Gate multi-file mutations behind a single AskUserQuestion at skill start: 'This review will update your plan file and project config. Proceed?' Only then execute writes.
- 08SQP-285%MEDIUM
SKILL.md.tmpl:78
detailhide
The 'PRE-REVIEW SYSTEM AUDIT' section executes multiple file system operations (git log, git diff, file reads) and network operations (WebSearch, remote-slug lookup) without explicit user confirmation or visible disclosure of what data is being accessed. The bash commands use `2>/dev/null` to suppress error output, which reduces visibility into what operations succeed or fail. A developer reviewing a plan could unknowingly trigger git operations, file reads from sensitive directories, or network requests.
76Before doing anything else, gather context about the developer-facing product.7778```bash79git log --oneline -1580git diff $(git merge-base HEAD main 2>/dev/null || echo HEAD~10) --stat 2>/dev/nullfix (1) Add an explicit AskUserQuestion before running PRE-REVIEW SYSTEM AUDIT: 'I will now scan your repository and project context. This will: execute git commands, read project files, and potentially query network resources. Proceed? A) Yes, scan my repo B) No, skip C) Show me what commands will run'. (2) Remove `2>/dev/null` suppressions to show users what operations executed. (3) Document each git/fs/network operation in plain language before executing it.
- 09TM1Tool Parameter Abuse85%HIGH
SKILL.md:278
detailhide
The code runs `git rm -r .claude/skills/gstack/` automatically as part of migration prompt handling. This is a destructive operation that can fail silently if `git` is not in PATH or if the directory does not exist. More critically, this code is in the skill definition (not user code), meaning it is under attacker control if the skill file is compromised. An attacker can inject a modified skill that runs `git rm -r` on arbitrary paths.
- B) No, I'll handle it myself If A: 1. Run `git rm -r .claude/skills/gstack/` 2. Run `echo '.claude/skills/gstack/' >> .gitignore` 3. Run `~/.claude/skills/gstack/bin/gstack-team-init required` (or `optional`) 4. Run `git add .claude/ .gitignore CLAUDE.md && git commit -m "chore: migrate gstack from vendored to team mode"`fix Never use `git rm` or other destructive git commands in skill code. Make the user explicitly run migration commands via a documented bash snippet, not automated execution. If automation is necessary, require explicit user confirmation via AskUserQuestion immediately before the destructive operation, and use only safe operations (e.g., `git status` to check, then ask 'Ready to run this command?').