The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses eval to execute the shell output of a local script located at ~/.claude/skills/econstack/bin/econstack-slug. Executing arbitrary output from a script via eval is a high-risk pattern that can lead to unintended shell command execution.
[COMMAND_EXECUTION]: Multiple binaries and scripts (such as econstack-update-check and econstack-learnings-log) are executed from hidden local directories. The instructions explicitly direct the agent to run these 'silently', which bypasses user visibility into the agent's actions.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to recommend that the user git clone and git pull from an external GitHub repository (https://github.com/charlescoverdale/econstack-data.git) to maintain a parameter database. This repository is not controlled by a recognized trusted organization.
[REMOTE_CODE_EXECUTION]: By combining git pull from an external source with the execution of scripts and binaries from the same or related paths, the skill creates a vector for remote code execution via a supply-chain style attack if the external repository is compromised.
[DATA_EXFILTRATION]: The skill includes instructions to log insights using a binary named econstack-learnings-log. While the documentation claims no data is transmitted externally, the actual network behavior of this binary cannot be verified through the provided instructions.

longlist