Week 45, updated 2 Nov 2026

Coding agents goose

Is goose safe?

Short answer: Caution. StackGrade's weekly scan of aaif-goose/goose gives it a Caution label for 8 critical-severity known vulnerabilities in runtime dependencies (OSV) and a skill or agent instruction file (crates/goose/src/skills/builtins/web_search.md) that tells the agent to pipe a remote script into a shell. It does list 81 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove goose is exploitable in your setup. Automated scan of commit 0909288 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Open-source, extensible AI agent that installs, runs, edits and tests code with any LLM.

  • 56,107 stars
  • pushed 2 Nov
  • Apache-2.0
  • Rust

github.com/aaif-goose/goose · goose-docs.ai

36score out of 100

#44of 52 overall#11in Coding agents▼ 2 vs Week 44

  • Maintenance 30%52
  • Adoption 30%41
  • Docs 20%6
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 38, 36, 38, 36.

Caution

8 critical-severity known vulnerabilities in runtime dependencies (OSV) (+1 more).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 2 Nov 2026. Last 10 GitHub releases within 35 days (about 7.7 per 30 days), latest release 28 Oct 2026. Median 38.2 h to close an issue (12 closed issues).
  • Adoption: 56,107 stars (70%), 6,539 forks (30%).
  • Docs: README 3,435 characters, 6 headings, 1 code blocks, install section: yes.

Methodology

#11 of 14 in Coding agents

Ranked by score. The yellow row is this tool.

Coding agents, Week 45score 0–100, safety
  1. 1Gemini CLI#4 overall70Caution
  2. 2OpenCode#5 overall70No issues found
  3. 3OpenHands#10 overall68Caution
  4. 4Claude Code#11 overall65No dependencies scanned
  5. 5Cline#12 overall65Caution
  6. 6Codex#16 overall58Caution
  7. 7deepseek-harness#17 overall57Caution
  8. 8KiroCrew#27 overall52Caution
  9. 9magpie#28 overall51No issues found
  10. 10Continue#43 overall37Caution
  11. 11goose#44 overall36Caution
Show the other 3
  1. 12Aider#45 overall31Caution
  2. 13codex-plugin-cc#48 overall29No issues found
  3. 14Roo Code#51 overall23Caution

Safety scan, 2 Nov 2026

Automated scan of commit 0909288, 1,990 files. Not a manual audit.

Caution

  • 8Critical dependency advisories81 high, 76 medium, 20 low. OSV, runtime dependencies only.
  • 1Install hooksnpm scripts that run on install; none downloads remote content.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 136Agent files checked1 file tells the agent to pipe a script into a shell.
  • 10curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 8 critical-severity known vulnerabilities in runtime dependencies (OSV)
  • Skill/agent file instructs piping a remote script into a shell: crates/goose/src/skills/builtins/web_search.md — curl -LsSf https://astral.sh/uv/install.sh | sh

Known vulnerabilities in runtime dependencies (OSV): 8 critical, 81 high, 76 medium, 20 low, 6 unrated

  • zip@8.6.0 (RUSTSEC-2026-0369) in Cargo.lock
  • zip@8.6.0 (GHSA-m665-v7pm-7grj) in Cargo.lock
  • proxy-addr@2.0.7 (GHSA-jqcg-44mw-7w3h) in documentation/package-lock.json
  • shell-quote@1.10.0 (GHSA-pqg4-j6r4-53mv) in documentation/package-lock.json
  • tinypool@1.1.1 (GHSA-5gmw-xhrv-c9v3) in documentation/package-lock.json

Also found (informational, does not change the label):

  • 81 high-severity known vulnerabilities in runtime dependencies (OSV)
  • 1 npm install hook, none downloading remote content
  • Program code runs a curl|sh style installer (6 occurrences, e.g. crates/goose/src/providers/amp_acp.rs)
  • Documents curl|sh style installer (8 occurrences, e.g. .github/workflows/python-sdk-wheels.yml)
  • Critical advisories counted once per package: 9 matches across 4 lockfiles

Notes:

  • 1 affected package only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: telemetry, posthog, amplitude

Automated scan of commit 0909288 on 2 Nov 2026, not a manual audit. 1,990 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest v1.57.0, 28 Oct
  • 38hMedian issue closeOver 12 closed issues
  • 56.1kStars+387 since 26 Oct
  • 6.5kForks540 open issues
  • 2024Repo created23 Aug 2024
30 days ago2 Nov
6 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

6 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about goose

Answers use this week's StackGrade data.

Is goose safe to use?

Caution. StackGrade's weekly scan of aaif-goose/goose gives it a Caution label for 8 critical-severity known vulnerabilities in runtime dependencies (OSV) and a skill or agent instruction file (crates/goose/src/skills/builtins/web_search.md) that tells the agent to pipe a remote script into a shell. It does list 81 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove goose is exploitable in your setup. Automated scan of commit 0909288 on 2 Nov 2026, not a manual audit.

How does StackGrade score goose?

goose scores 36 out of 100 in Week 45: #44 of 52 tracked tools overall and #11 in Coding agents. The score combines maintenance (52), adoption (41) and docs (6) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to goose?

The highest-scored other tools in Coding agents this week: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Claude Code (65, No dependencies scanned). StackGrade has not tested them hands-on.

What licence does goose use?

The licence listed for aaif-goose/goose is Apache-2.0. Read the licence text before commercial use.

Compare and use it

Used in 1 AI use case

All facts and sources
Type
AI tool
License
Apache-2.0
Language
Rust
Created
23 Aug 2024
Owner
aaif-goose (Organization)
Forks
6,539

GitHub description: “an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM”

Sources: github.com/aaif-goose/goose, api.github.com/repos/aaif-goose/goose, raw.githubusercontent.com/aaif-goose/goose/main/README.md. Fetched 2 Nov 2026.

Know when goose changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.