Yggdrasilgsd-build/gsd-2
↗ GitHubA powerful meta-prompting, context engineering and spec-driven development system that enables agents to work for long periods of time autonomously without losing track of the big picture
4,008
Stars
409
Forks
12
Watchers
407
Open Issues
Safety Rating A
The repository appears to be a legitimate, well-maintained open source AI coding agent tool with 4,000+ stars, an active changelog, proper MIT licensing, and comprehensive documentation. No hardcoded secrets, malicious code patterns, or suspicious dependency declarations are visible in the provided content. The README explicitly notes privacy-conscious defaults (e.g., RTK_TELEMETRY_DISABLED=1 forced for managed binaries, opt-in telemetry). A notable transparency disclosure is present regarding OAuth token usage risks with Google and Anthropic providers, which reflects responsible disclosure rather than malicious intent. No prompt injection attempts targeting AI analysts were found.
ℹAI-assisted review, not a professional security audit.
AI Analysis
GSD-2 is a TypeScript-based autonomous coding agent CLI and framework that implements meta-prompting, context engineering, and spec-driven development patterns. It builds on the Pi SDK to provide programmatic control over LLM agent sessions, enabling fully autonomous software development workflows. Key capabilities include a state-machine-driven auto-loop that dispatches fresh context windows per task, git worktree isolation, crash recovery, cost tracking, stuck detection, verification enforcement, parallel milestone orchestration, and a VS Code extension with web UI.
Use Cases
- Autonomous end-to-end software development with minimal human intervention
- Structured project planning decomposed into milestones, slices, and tasks
- CI/CD pipeline integration for automated code generation and verification
- Multi-provider LLM orchestration with per-phase model routing and fallback chains
- Context engineering and prompt management for long-running agent sessions
- Team-based development with shared project state and unique milestone coordination
Tags
Security Findings (2)
No manifest files (package.json, lock files) were included in the provided repository content, so a full dependency vulnerability scan could not be performed. No obvious CVEs are detectable from the README alone.
No prompt injection attempts detected in the README or metadata. The README is a standard technical product documentation file with no embedded instructions targeting AI analysts.
Project Connections
Pi SDK (pi-mono)
GSD-2 is explicitly built on the Pi SDK (badlogic/pi-mono) and uses it as its core agent harness for session management, provider abstraction, and tool execution.
Claude Code
GSD-2 originated as a prompt framework for Claude Code and continues to support Claude Code CLI as a provider extension, complementing Anthropic's native coding assistant.
OpenRouter
GSD-2 integrates OpenRouter as a built-in provider, allowing users to route agent tasks to hundreds of models through a single API key alongside GSD's per-phase model routing.
Get Shit Done (gsd-build/get-shit-done)
GSD-2 is explicitly described as the evolution of the original 'Get Shit Done' prompt framework, superseding it with a full TypeScript agent application.
RTK (rtk-ai/rtk)
GSD-2 provisions and manages an RTK binary to compress shell-command output in bash and verification flows, with forced telemetry-disabled settings for managed invocations.