The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to manage project state, configuration, and repository files.
Evidence: Runs gstack-config, gstack-team-init, git rm, git add, and git commit to manage project settings and handle the migration from vendored to team mode.
Evidence: Uses mkdir -p, touch, find, sort, and head to manage and locate checkpoint files in the user's home directory.
Evidence: Uses eval to execute output from local binaries (gstack-slug and gstack-paths) to set up the environment. This pattern allows the execution of dynamically generated shell code from external binaries.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes untrusted data from checkpoint files.
Ingestion points: The skill reads markdown files located in ~/.gstack/projects/$SLUG/checkpoints/ using the Read tool.
Boundary markers: Absent. The content from the saved files (summary, notes, etc.) is interpolated directly into the agent's context without delimiters or warnings to ignore embedded instructions.
Capability inventory: The agent has the ability to execute shell commands, perform git operations, and run custom scripts/binaries.
Sanitization: Absent. There is no validation or escaping of the content read from the checkpoint files before it is presented to the agent.

context-restore