@garrytan Second PR today with the same pattern as #862. Another external dependency from the same GitHub org wired into all 30+ generated SKILL.md files. 50 files touched, 2097 lines added.

Combined with #862 that is 102 files and 5400 lines of additions in a single day, both embedding external MCP servers into every gstack skill. The security and performance concerns from my review on #862 apply here as well.

Recommend not merging either PR. Both wire external MCP servers with no content sanitization into an LLM context that has shell access on every user's machine.

Thanks for the review @garagon. Want to clarify how this differs from #862 since the concerns don't apply the same way:

Not the same pattern. This PR has zero ReadMcpResourceTool calls, zero sqry:// URIs, and zero content loaded from external MCP servers into the LLM context. The resolver emits static markdown with MCP tool names — it tells the agent "here are tools you can call," not "read this external content."

Actual diff: 20 files, 1502 lines (not 50/2097 — the generated SKILL.md files were removed from the diff in the force-push before your comment).

Point-by-point on the #862 concerns:

The resolver output is a conditional markdown block like:

If preamble shows LLM_GATEWAY: unavailable: skip this section entirely.
...
- `mcp__llm-cli-gw__gemini_request_async` — dispatch Gemini review in parallel

No external content is fetched, read, or injected. The MCP tools are called by the agent at runtime through the standard MCP protocol with normal tool-call semantics — same as any other registered MCP server.

Happy to discuss further or make changes if there are specific concerns with this approach.

To clarify: "same pattern" refers to the contribution pattern, not the resolver implementation. Two PRs in a single day from the same author wiring two separate dependencies from the same GitHub org across multiple gstack skills. The org was created recently.

Reviewed the llm-cli-gateway source code (https://github.com/verivus-oss/llm-cli-gateway). Some observations on what users would be installing:

• The package hardcodes sqry as a default MCP server when no servers are specified (src/index.ts line 392). The two tools are designed to work together.
• A flight recorder logs all user prompts and AI responses to a plaintext SQLite database at ~/.llm-cli-gateway/logs.db, enabled by default (src/flight-recorder.ts). There is no clear reason for a CLI gateway to silently record every conversation to disk without explicit user consent.
• Spawned processes inherit the full process.env including all API keys and credentials in the user's environment (src/executor.ts line 165).
• The package includes a dangerouslySkipPermissions flag that passes --permission-mode bypassPermissions to the invoked CLIs (src/index.ts line 731).
• The npm package was published 6 days ago (https://www.npmjs.com/package/llm-cli-gateway).

The supply chain risk here is real. A lot of people use gstack daily and trust what gets merged. That is for @garrytan to decide.

Gus