retro
“Weekly engineering retrospective. (gstack)”
aipkg.jsonLICENSE.txtREADME.mdSKILL.mdSKILL.md.tmpl- 01SDI-385%HIGH
SKILL.md:6
detailhide
The manifest declares allowed-tools: [Bash, Read, Write, Glob, AskUserQuestion], but the preamble executes external binaries not in that list: gstack-update-check, gstack-config, gstack-repo-mode, gstack-slug, gstack-learnings-search, gstack-telemetry-log, gstack-timeline-log, gstack-brain-sync, gstack-question-preference, etc. This violates the principle of least privilege — the skill is claiming it only uses 5 tools but actually invokes 15+ binaries. An attacker could replace any of these binaries in ~/.claude/skills/gstack/bin/ to execute arbitrary code.
4version: 2.0.05description: Weekly engineering retrospective. (gstack)6allowed-tools:7 - Bash8 - Readfix Update the allowed-tools manifest to include the actual tools invoked: add 'ExternalBinary' or similar, OR enumerate each binary explicitly (gstack-update-check, gstack-config, gstack-repo-mode, etc.). If the manifest cannot list all binaries, restrict execution to signed binaries in a protected directory with integrity verification.
- 02SDI-285%MEDIUM
SKILL.md.tmpl:648
detailhide
The skill invokes an external discovery binary (`gstack-global-discover`) via multiple fallback paths without any integrity verification, code review, or hash validation. An attacker who can place a malicious binary in any of these fallback paths (e.g., `~/.claude/skills/gstack/bin/`, `.claude/skills/gstack/bin/`, or in PATH) can execute arbitrary code with the skill's privileges. The fallback to `bun run bin/gstack-global-discover.ts` further increases the attack surface by executing TypeScript files from the filesystem without validation.
646### Global Step 2: Run discovery647648Locate and run the discovery script using this fallback chain:649650```bashfix Require explicit, hardcoded paths to trusted binaries with hash validation. Store the discovery binary as an embedded resource in the skill package or require a pinned checksum. Remove the fallback chain entirely — do not search PATH. Require the user to explicitly configure the binary path via an environment variable (e.g., `GSTACK_DISCOVER_BIN`) if it must be external. Alternatively, implement the discovery logic directly in the skill template to avoid subprocess invocation.
- 03SDI-380%MEDIUM
SKILL.md.tmpl:93
detailhide
The skill reads user-authored context files (`~/.gstack/retro-context.md`, `~/.gstack/greptile-history.md`, `TODOS.md`) and incorporates their content directly into narrative output without sanitization or validation. If an attacker can write to these files (possible via supply chain compromise, unrelated script, or misconfigured permissions), they can inject arbitrary markdown, prompt injections, or exfiltration payloads that the skill will echo back to the user or include in saved JSON snapshots. The skill also reads environment-based paths and credential locations without explicit allowlisting.
9192```bash93[ -f ~/.gstack/retro-context.md ] && echo "RETRO_CONTEXT_FOUND" || echo "NO_RETRO_CONTEXT"94```95fix Validate and sanitize all file contents before incorporation into narrative or JSON output. Use a strict allowlist of permitted file paths. Remove sensitive context files from the read pipeline, or restrict reads to user-owned files with restrictive permissions (e.g., `0600`). For each external file, clearly label it as 'user-provided context' in the output so users understand it is not verified. Consider moving sensitive context to a secure, signed configuration format.