SECURITY issues from Installation and use of this Stack

[GCMO]

Hi Garry,
Understanding that this repo has access to Chromium, I curiously quickly asked Claude:
"WHAT ARE THE SECURITY RISKS OF INSTALLING AND RUNNING THIS REPO?" Here is what it said:

Security risks from installation and use

Risk	What happens	Mitigation
Supply chain / untrusted clone	git clone + bun install + compiled binaries run on your machine with your user privileges.	Clone only from garrytan/gstack; verify commit/tag for production; review diffs on git pull; prefer shallow clone only if you accept less audit history.
Over-powered agent workflows	Skills like /ship, /land-and-deploy, /qa, /design-review instruct the agent to run tests, edit code, commit, push, open PRs, and browse staging URLs.	Use read-only skills first (qa-only, plan-* reviews); enable /careful, /freeze, /guard; never run ship/deploy skills on repos you don’t own; review diffs before any push.
Local browse daemon + bearer token	Daemon binds 127.0.0.1; token stored in ~/.gstack/.../browse.json (mode 0600). Any local process could try to use a leaked token.	Don’t run untrusted code as your user alongside gstack; lock down shared machines; stop daemon when idle (browse idle timeout ~30 min).
Cookie / session import	/setup-browser-cookies and cookie picker read real browser cookie DBs (Keychain on macOS). Sessions can access logged-in sites.	Only import on a dedicated profile; approve Keychain prompts consciously; don’t browse untrusted sites in the same headed session; treat imported cookies like passwords.
ngrok / pair-agent tunnel	Remote agents can drive a limited browser command surface via tunnel; misconfiguration could expose more than intended.	Use pair-agent only when needed; don’t expose tunnel without understanding dual-listener architecture; prefer same-machine pairing; monitor ~/.gstack/security/attempts.jsonl.
Prompt injection via browsing	Malicious pages can try to hijack agent instructions; gstack adds ML + canary defenses but they’re not perfect.	Keep GSTACK_SECURITY_OFF=0 unless debugging; don’t point QA at arbitrary user URLs; use GSTACK_SECURITY_ENSEMBLE=deberta only if you accept 721MB model download and trust the stack.
Telemetry	Opt-in usage events (skill name, duration, version — not code/prompts).	Decline on first prompt; gstack-config set telemetry off; audit supabase/migrations/ if paranoid.
GBrain / memory sync	Optional sync to a private git repo; secret scanner blocks many patterns but not all leaks.	Start with sync off or “artifacts only”; run /learn and brain sync only with repos you trust; never sync .env or credentials.
API keys in paid evals	Dev docs reference ANTHROPIC_API_KEY, Codex auth under ~/.codex/ — not required for normal Cursor install.	Don’t run bun run test:evals unless you intend to spend money; keep keys out of project trees gstack might read.
Large ML downloads	First security scan may download ~112MB (TestSavant); optional DeBERTa ~721MB.	Pre-download on trusted network; set GSTACK_SECURITY_OFF=1 only for emergency (reduces ML, not all risk).
Chrome extension + PTY	Extension can inject into terminal, WebSocket auth via Sec-WebSocket-Protocol.	Install extension only from this repo’s extension/ build; understand sidebar message flow; don’t expose /health tokens beyond localhost.
Windows CDP cookie path	Documented elevation: debugging port can worsen cookie exposure on Windows.	On Windows, avoid cookie-import + remote debugging combo until fixed; prefer macOS/Linux for sensitive cookie workflows.
Symlink install layout	Global ~/.cursor/skills/gstack-* → your clone: deleting/moving the clone breaks skills.	Pin GSTACK=~/gstack; avoid git pull from untrusted contributors without review; use dedicated clone path.
Auto-upgrade / team mode	Claude SessionStart hook can git pull gstack hourly (team mode).	Don’t enable --team on Cursor-only setups unless you want that behavior in Claude Code; review ~/.gstack/config.yaml.
Skill name confusion	Many similarly named skills; wrong skill → wrong actions (e.g. QA vs qa-only).	Read skill descriptions in Cursor; start with explicit names; use freeze to limit directories.

Now, Im not investor or journalist, but one thing is sure a lot of people will think that you shared this security risks on purpose.
I hope you see this list and focus or have someone focus mainly on the tunneling and injections risks.

[garrytan]

Closing — this reads as a generic AI-generated security checklist with no specific vulnerability claim against gstack. The architecture docs (ARCHITECTURE.md §dual-listener tunnel, the layered injection defense L1–L6 documented in CLAUDE.md) cover the surfaces this lists. If you've found a specific, reproducible vulnerability, please report privately via GitHub Security Advisory rather than a public issue. Thanks.

[zeornelas]

@garrytan Just tried to installing this using npx skills add garrytan/gstack and got this on the Security Risk Assessments:

Might be worth a look?