Skip to main content

qa-only

Report-only QA testing. Systematically tests a web application and produces a structured report with health score, screenshots, and repro steps — but never fixe

0/100

Security score

The qa-only skill was audited on Mar 16, 2026 and we found 23 security issues across 4 threat categories, including 2 critical. Review the findings below before installing.

Categories Tested

Security Issues

critical line 112

Piping content to bash shell

SourceSKILL.md
1101. Tell the user: "gstack browse needs a one-time build (~10 seconds). OK to proceed?" Then STOP and wait.
1112. Run: `cd <SKILL_DIR> && ./setup`
1123. If `bun` is not installed: `curl -fsSL https://bun.sh/install | bash`
113
114**Create output directories:**
low line 21

Command substitution pattern

SourceSKILL.md
19
20```bash
21_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)
22[ -n "$_UPD" ] && echo "$_UPD" || true
23mkdir -p ~/.gstack/sessions
low line 25

Command substitution pattern

SourceSKILL.md
23mkdir -p ~/.gstack/sessions
24touch ~/.gstack/sessions/"$PPID"
25_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
26find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true
27_CONTRIB=$(~/.claude/skills/gstack/bin/gstack-config get gstack_contributor 2>/dev/null || true)
low line 27

Command substitution pattern

SourceSKILL.md
25_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
26find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true
27_CONTRIB=$(~/.claude/skills/gstack/bin/gstack-config get gstack_contributor 2>/dev/null || true)
28```
29
low line 98

Command substitution pattern

SourceSKILL.md
96
97```bash
98_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
99B=""
100[ -n "$_ROOT" ] && [ -x "$_ROOT/.claude/skills/gstack/browse/dist/browse" ] && B="$_ROOT/.claude/skills/gstack/browse/dist/browse"
low line 129

Command substitution pattern

SourceSKILL.md
1271. **Project-scoped test plans:** Check `~/.gstack/projects/` for recent `*-test-plan-*.md` files for this repo
128 ```bash
129 SLUG=$(git remote get-url origin 2>/dev/null | sed 's|.*[:/]\([^/]*/[^/]*\)\.git$|\1|;s|.*[:/]\([^/]*/[^/]*\)$|\1|' | tr '/' '-')
130 ls -t ~/.gstack/projects/$SLUG/*-test-plan-*.md 2>/dev/null | head -1
131 ```
low line 421

Command substitution pattern

SourceSKILL.md
419**Project-scoped:** Write test outcome artifact for cross-session context:
420```bash
421SLUG=$(git remote get-url origin 2>/dev/null | sed 's|.*[:/]\([^/]*/[^/]*\)\.git$|\1|;s|.*[:/]\([^/]*/[^/]*\)$|\1|' | tr '/' '-')
422mkdir -p ~/.gstack/projects/$SLUG
423```
high line 112

Curl to non-GitHub URL

SourceSKILL.md
1101. Tell the user: "gstack browse needs a one-time build (~10 seconds). OK to proceed?" Then STOP and wait.
1112. Run: `cd <SKILL_DIR> && ./setup`
1123. If `bun` is not installed: `curl -fsSL https://bun.sh/install | bash`
113
114**Create output directories:**
low line 21

Access to home directory dotfiles

SourceSKILL.md
19
20```bash
21_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)
22[ -n "$_UPD" ] && echo "$_UPD" || true
23mkdir -p ~/.gstack/sessions
low line 23

Access to home directory dotfiles

SourceSKILL.md
21_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)
22[ -n "$_UPD" ] && echo "$_UPD" || true
23mkdir -p ~/.gstack/sessions
24touch ~/.gstack/sessions/"$PPID"
25_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
low line 24

Access to home directory dotfiles

SourceSKILL.md
22[ -n "$_UPD" ] && echo "$_UPD" || true
23mkdir -p ~/.gstack/sessions
24touch ~/.gstack/sessions/"$PPID"
25_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
26find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true
low line 25

Access to home directory dotfiles

SourceSKILL.md
23mkdir -p ~/.gstack/sessions
24touch ~/.gstack/sessions/"$PPID"
25_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
26find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true
27_CONTRIB=$(~/.claude/skills/gstack/bin/gstack-config get gstack_contributor 2>/dev/null || true)
low line 26

Access to home directory dotfiles

SourceSKILL.md
24touch ~/.gstack/sessions/"$PPID"
25_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
26find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true
27_CONTRIB=$(~/.claude/skills/gstack/bin/gstack-config get gstack_contributor 2>/dev/null || true)
28```
low line 27

Access to home directory dotfiles

SourceSKILL.md
25_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
26find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true
27_CONTRIB=$(~/.claude/skills/gstack/bin/gstack-config get gstack_contributor 2>/dev/null || true)
28```
29
medium line 30

Access to home directory dotfiles

SourceSKILL.md
28```
29
30If output shows `UPGRADE_AVAILABLE <old> <new>`: read `~/.claude/skills/gstack/gstack-upgrade/SKILL.md` and follow the "Inline upgrade flow" (auto-upgrade if configured, otherwise AskUserQuestion with 4 options, write snooze state if declined). If `JUST_UPGRADED <from> <to>`: tell user "Running gstack v{to} (just updated!)" and continue.
31
32## AskUserQuestion Format
medium line 51

Access to home directory dotfiles

SourceSKILL.md
49**NOT gstack issues:** user's app bugs, network errors to user's URL, auth failures on user's site.
50
51**To file:** write `~/.gstack/contributor-logs/{slug}.md` with this structure:
52
53```
medium line 71

Access to home directory dotfiles

SourceSKILL.md
69```
70
71Then run: `mkdir -p ~/.gstack/contributor-logs && open ~/.gstack/contributor-logs/{slug}.md`
72
73Slug: lowercase, hyphens, max 60 chars (e.g. `browse-snapshot-ref-gap`). Skip if file already exists. Max 3 reports per session. File inline and continue — don't stop the workflow. Tell user: "Filed gstack field report: {title}"
low line 101

Access to home directory dotfiles

SourceSKILL.md
99B=""
100[ -n "$_ROOT" ] && [ -x "$_ROOT/.claude/skills/gstack/browse/dist/browse" ] && B="$_ROOT/.claude/skills/gstack/browse/dist/browse"
101[ -z "$B" ] && B=~/.claude/skills/gstack/browse/dist/browse
102if [ -x "$B" ]; then
103 echo "READY: $B"
medium line 127

Access to home directory dotfiles

SourceSKILL.md
125Before falling back to git diff heuristics, check for richer test plan sources:
126
1271. **Project-scoped test plans:** Check `~/.gstack/projects/` for recent `*-test-plan-*.md` files for this repo
128 ```bash
129 SLUG=$(git remote get-url origin 2>/dev/null | sed 's|.*[:/]\([^/]*/[^/]*\)\.git$|\1|;s|.*[:/]\([^/]*/[^/]*\)$|\1|' | tr '/' '-')
low line 130

Access to home directory dotfiles

SourceSKILL.md
128 ```bash
129 SLUG=$(git remote get-url origin 2>/dev/null | sed 's|.*[:/]\([^/]*/[^/]*\)\.git$|\1|;s|.*[:/]\([^/]*/[^/]*\)$|\1|' | tr '/' '-')
130 ls -t ~/.gstack/projects/$SLUG/*-test-plan-*.md 2>/dev/null | head -1
131 ```
1322. **Conversation context:** Check if a prior `/plan-eng-review` or `/plan-ceo-review` produced test plan output in this conversation
low line 422

Access to home directory dotfiles

SourceSKILL.md
420```bash
421SLUG=$(git remote get-url origin 2>/dev/null | sed 's|.*[:/]\([^/]*/[^/]*\)\.git$|\1|;s|.*[:/]\([^/]*/[^/]*\)$|\1|' | tr '/' '-')
422mkdir -p ~/.gstack/projects/$SLUG
423```
424Write to `~/.gstack/projects/{slug}/{user}-{branch}-test-outcome-{datetime}.md`
medium line 424

Access to home directory dotfiles

SourceSKILL.md
422mkdir -p ~/.gstack/projects/$SLUG
423```
424Write to `~/.gstack/projects/{slug}/{user}-{branch}-test-outcome-{datetime}.md`
425
426### Output Structure
critical line 112

Curl pipe to interpreter

SourceSKILL.md
1101. Tell the user: "gstack browse needs a one-time build (~10 seconds). OK to proceed?" Then STOP and wait.
1112. Run: `cd <SKILL_DIR> && ./setup`
1123. If `bun` is not installed: `curl -fsSL https://bun.sh/install | bash`
113
114**Create output directories:**
Scanned on Mar 16, 2026
View Security Dashboard