uStack

Universal agent workspace compatibility and update engine. Track upstream agent frameworks (like gstack), analyze every change, classify portability, and gen...

uStack appears coherent: it clones/pulls Git repos and analyzes their contents, writes artifacts to .ustack/, and generates Markdown pages. Before installing or running: 1) be aware it requires Node >=20 and git (run in an environment with those installed); the registry metadata did not list these—that's an inconsistency. 2) Only import repositories you trust or run ustack in an isolated directory/container, since it will clone arbitrary repos and write files locally. 3) Review the generated .ustack content and manifests before using any adapted output in production. 4) Note there are minor code/quality issues (e.g., a missing fs import in one extractor) — these look like bugs, not malicious behavior. If you need stronger guarantees, run it in a sandboxed environment or inspect the cloned repo contents before further automated processing.

Type: OpenClaw Skill Name: ustack Version: 0.1.0 The ustack skill bundle provides a framework for tracking and analyzing external agent repositories but contains several critical shell injection vulnerabilities. Specifically, `src/lib/git.js` uses `execSync` to execute git commands (log, diff, show) with unsanitized variables such as commit SHAs and file paths. While these capabilities are consistent with the tool's stated purpose, the lack of input validation allows for potential arbitrary command execution if the underlying git metadata or user-supplied identifiers are manipulated. Additionally, the tool performs file system operations and clones external repositories (e.g., from github.com/garrytan/gstack) into a local `.ustack` directory without sufficient sanitization of the source content.