gsd-build/get-shit-done agent hook
archived
This repository is an archived redirect for the GSD (Get Shit Done) project. Active development has moved to GSD Core in the Open GSD repository. This location is no longer maintained.
Refer to the Open GSD repository (github.com/open-gsd/gsd-core) for current source code File issues and feature requests in the new GSD Core repository Access the latest releases from the active GSD Core project Contribute changes to the Open GSD repository instead of this archived location 4 CRITICAL✓ 2 HIGH✓ 118 MEDIUM 4 LOW
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 6 likely real (100%) 5 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 3 high-signal, 3 mostly false-positive (hidden by default)
CHK-081 2 findings 2 likely
0% FP CHK-035 2 findings 2 likely
0% FP CHK-089 1 finding 1 likely
0% FP ▼ Show 3 checkers that are mostly false positives (6 findings) 128 findings click to expand
CHK-089 --dangerously-skip-permissions in executable — all permission checks bypassed
sdk/src/session-runner.ts
AI: likely real confirmed ▼
CHK-080 Node.js vm module used as sandbox — vm is NOT a security boundary
scripts/build-hooks.js
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in tests/helpers.cjs
tests/helpers.cjs
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in hooks/gsd-check-update-worker.js
hooks/gsd-check-update-worker.js
AI: likely real confirmed ▼
CHK-035 [GHSA-96hv-2xvq-fx4p] ws — ws: Memory exhaustion DoS from tiny fragments and data chunks
AI: likely real confirmed ▼
CHK-035 [GHSA-88fw-hqm2-52qc] hono — hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
AI: likely real confirmed ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in .changeset/mellow-herons-greet.md
.changeset/mellow-herons-greet.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in .changeset/3347-graphify-auto-update-hook.md
.changeset/3347-graphify-auto-update-hook.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in .changeset/happy-jays-wake.md
.changeset/happy-jays-wake.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in .changeset/tidy-tunas-zip.md
.changeset/tidy-tunas-zip.md
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in tests/helpers.cjs
tests/helpers.cjs
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in agents/gsd-ui-researcher.md
agents/gsd-ui-researcher.md
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in agents/gsd-code-reviewer.md
agents/gsd-code-reviewer.md
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in agents/gsd-ui-auditor.md
agents/gsd-ui-auditor.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in sdk/README.md
sdk/README.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in sdk/HANDOVER-QUERY-LAYER.md
sdk/HANDOVER-QUERY-LAYER.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in sdk/HANDOVER-PARITY-DOCS.md
sdk/HANDOVER-PARITY-DOCS.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in sdk/HANDOVER-GOLDEN-PARITY.md
sdk/HANDOVER-GOLDEN-PARITY.md
possible ▼
CHK-125 child_process module — shell execution — no scope constraint in hooks/gsd-check-update.js
hooks/gsd-check-update.js
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hooks/gsd-context-monitor.js
hooks/gsd-context-monitor.js
possible ▼
CHK-125 child_process module — shell execution — no scope constraint in hooks/gsd-check-update-worker.js
hooks/gsd-check-update-worker.js
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in scripts/release-tarball-smoke.cjs
scripts/release-tarball-smoke.cjs
possible ▼
CHK-125 child_process module — shell execution — no scope constraint in scripts/run-tests.cjs
scripts/run-tests.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/lint-pr-check-project-dir.cjs
scripts/lint-pr-check-project-dir.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/audit-workflow-script-paths.cjs
scripts/audit-workflow-script-paths.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/pr-template-policy.cjs
scripts/pr-template-policy.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/command-contract-helpers.cjs
scripts/command-contract-helpers.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/lint-no-source-grep.cjs
scripts/lint-no-source-grep.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/lint-no-source-grep-extras.cjs
scripts/lint-no-source-grep-extras.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/lint-skill-deps.cjs
scripts/lint-skill-deps.cjs
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in scripts/build-hooks.js
scripts/build-hooks.js
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scripts/lint-shell-command-projection-drift.cjs
scripts/lint-shell-command-projection-drift.cjs
possible ▼
CHK-125 child_process module — shell execution — no scope constraint in helpers/graphify.cjs
tests/helpers/graphify.cjs
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in helpers/cli-negative.cjs
tests/helpers/cli-negative.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in src/phase-prompt.ts
sdk/src/phase-prompt.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/gsd-tools.ts
sdk/src/gsd-tools.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in src/plan-parser.ts
sdk/src/plan-parser.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/sdk-package-compatibility.ts
sdk/src/sdk-package-compatibility.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/query-execution-policy.ts
sdk/src/query-execution-policy.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/types.ts
sdk/src/types.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in src/phase-runner.ts
sdk/src/phase-runner.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in src/query-command-executor.ts
sdk/src/query-command-executor.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/query-gsd-tools-runtime.ts
sdk/src/query-gsd-tools-runtime.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in runtime-bridge-sync/worker.ts
sdk/src/runtime-bridge-sync/worker.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in golden/read-only-golden-rows.ts
sdk/src/golden/read-only-golden-rows.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in golden/capture.ts
sdk/src/golden/capture.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in golden/golden-policy.ts
sdk/src/golden/golden-policy.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in golden/golden-mutation-covered.ts
sdk/src/golden/golden-mutation-covered.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in golden/init-golden-normalize.ts
sdk/src/golden/init-golden-normalize.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/state.ts
sdk/src/query/state.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in query/QUERY-HANDLERS.md
sdk/src/query/QUERY-HANDLERS.md
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/phase-lifecycle-policy.ts
sdk/src/query/phase-lifecycle-policy.ts
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in query/init.ts
sdk/src/query/init.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/verify.ts
sdk/src/query/verify.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/progress.ts
sdk/src/query/progress.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in query/worktree.ts
sdk/src/query/worktree.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/phase-lifecycle.ts
sdk/src/query/phase-lifecycle.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/uat.ts
sdk/src/query/uat.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/validate.ts
sdk/src/query/validate.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in query/check-ship-ready.ts
sdk/src/query/check-ship-ready.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in query/commit.ts
sdk/src/query/commit.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/profile.ts
sdk/src/query/profile.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in query/query-cli-output.ts
sdk/src/query/query-cli-output.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/roadmap.ts
sdk/src/query/roadmap.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/init-complex.ts
sdk/src/query/init-complex.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in query/intel.ts
sdk/src/query/intel.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in changeset/cli.cjs
scripts/changeset/cli.cjs
possible ▼
CHK-125b chmod — permission modification — no scope constraint in workflows/install-smoke.yml
.github/workflows/install-smoke.yml
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in references/planner-graphify-auto-update.md
get-shit-done/references/planner-graphify-auto-update.md
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in references/common-bug-patterns.md
get-shit-done/references/common-bug-patterns.md
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/state.cjs
get-shit-done/bin/lib/state.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/commands.cjs
get-shit-done/bin/lib/commands.cjs
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/commands.cjs
get-shit-done/bin/lib/commands.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/learnings.cjs
get-shit-done/bin/lib/learnings.cjs
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/learnings.cjs
get-shit-done/bin/lib/learnings.cjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in lib/shell-command-projection.cjs
get-shit-done/bin/lib/shell-command-projection.cjs
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/shell-command-projection.cjs
get-shit-done/bin/lib/shell-command-projection.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/intel.cjs
get-shit-done/bin/lib/intel.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/template.cjs
get-shit-done/bin/lib/template.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/phase.cjs
get-shit-done/bin/lib/phase.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/security.cjs
get-shit-done/bin/lib/security.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/verify.cjs
get-shit-done/bin/lib/verify.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/core.cjs
get-shit-done/bin/lib/core.cjs
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/core.cjs
get-shit-done/bin/lib/core.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/roadmap.cjs
get-shit-done/bin/lib/roadmap.cjs
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/planning-workspace.cjs
get-shit-done/bin/lib/planning-workspace.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/init.cjs
get-shit-done/bin/lib/init.cjs
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/surface.cjs
get-shit-done/bin/lib/surface.cjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in lib/graphify.cjs
get-shit-done/bin/lib/graphify.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/uat.cjs
get-shit-done/bin/lib/uat.cjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in lib/worktree-safety.cjs
get-shit-done/bin/lib/worktree-safety.cjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/gap-checker.cjs
get-shit-done/bin/lib/gap-checker.cjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in lib/state-command-router.cjs
get-shit-done/bin/lib/state-command-router.cjs
possible ▼
CHK-125a fs.readFile — filesystem read access — no scope constraint in codebase/testing.md
get-shit-done/templates/codebase/testing.md
possible ▼
CHK-036 [GHSA-q8mj-m7cp-5q26] qs 6.15.1 — see advisory: GHSA-q8mj-m7cp-5q26
possible ▼
CHK-054 Tool 'Bash' — generic name without namespace prefix (shadow risk)
sdk/src/event-stream.test.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in CONTRIBUTING.md
CONTRIBUTING.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in TEST-EXAMPLES.md
TEST-EXAMPLES.md
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in bin/gsd-sdk.js
bin/gsd-sdk.js
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in .changeset/shell-projection-subprocess-migration.md
.changeset/shell-projection-subprocess-migration.md
possible ▼
▼ Show 5 false positives (4% of this view) Last scanned: Jul 11, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.