The Agent Skills Directory

[COMMAND_EXECUTION]: The preamble automatically runs several shell commands to manage sessions, check for updates, and modify project files such as CLAUDE.md and .gitignore upon skill load.\n- [REMOTE_CODE_EXECUTION]: The skill dynamically executes command output using source <(...) and eval on the output of local binaries. It also executes scripts from the ~/.claude/skills/gstack/bin/ and ~/.claude/skills/gstack/gstack-upgrade/ directories, which are external to the skill's own package.\n- [DATA_EXFILTRATION]: Telemetry data, including skill usage statistics, repository names, and session identifiers, is collected and can be transmitted to a remote service via the gstack-telemetry-log binary, although user prompts for opt-out are provided.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted content from repository files and other installed skills during its auditing phases (e.g., Phase 8). Evidence chain: 1. Ingestion points include project code, config files, and other skill definitions; 2. Boundary markers are limited to natural language instructions (e.g., "Anti-manipulation" rule); 3. The skill possesses powerful tools including Bash, Agent, and Write; 4. No explicit sanitization or structural isolation is performed on the audited content.

cso