The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses eval to execute the output of a binary located at ~/.claude/skills/gstack/bin/gstack-slug. If an attacker replaces or modifies this binary, they can achieve arbitrary shell execution in the agent's context. Evidence: eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)".
[REMOTE_CODE_EXECUTION]: The skill locates and executes various binaries from the user's home directory (~/.claude/skills/gstack/...) and project-local paths. It uses these binaries ($D for design, $B for browse) to perform core tasks like image generation and serving local content. Executing untrusted or mutable binaries is a high-risk pattern. Evidence: [ -x "$HOME/.claude/skills/gstack/design/dist/design" ] && D="$HOME/.claude/skills/gstack/design/dist/design" followed by $D generate ....
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8). It ingests data from DESIGN.md and feedback.json (which may be written by a local HTTP server or the user) and interpolates this content into prompts for subagents. There are no clear boundary markers or sanitization steps to prevent malicious instructions in the feedback from hijacking subagent behavior.
Ingestion points: Reads feedback.json, feedback-pending.json, and DESIGN.md (SKILL.md).
Boundary markers: Absent. The data is directly interpolated into briefs.
Capability inventory: Subagents have access to the $D binary, shell commands (cp), and file system writes.
Sanitization: Absent. Content is treated as trusted design instructions.
[COMMAND_EXECUTION]: The skill manages a 'team mode' migration that involves running git rm -r on its own directory and executing a setup script gstack-team-init. This involves self-modification and execution of scripts from a directory it just manipulated.

design-shotgun