The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Bun installation script from 'bun.sh', which is a well-known technology service. This download includes a SHA-256 checksum verification step to ensure the integrity of the remote script before execution.
[REMOTE_CODE_EXECUTION]: The skill executes multiple local binaries and shell scripts associated with the 'gstack' framework (authored by charlieviettq), located in the user's home directory (~/.claude/skills/gstack/bin/). This includes patterns like 'eval "$(...)"' for dynamic script execution.
[COMMAND_EXECUTION]: The skill uses shell commands for environment discovery, including 'git remote', 'gh auth status', and 'glab auth status' to detect project context and platform availability. It also utilizes a 'browse' binary to interact with external web services.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of browsing and processing external web content.
Ingestion points: Untrusted data enters the agent context through the 'browse' tool while navigating documentation, API playgrounds, and web dashboards.
Boundary markers: Absent. The instructions do not specify delimiters or warnings for the agent to ignore instructions embedded in the crawled content.
Capability inventory: The agent has access to 'Bash' (running git, gh, and local vendor scripts) and 'Write' (modifying project files like CLAUDE.md and .gitignore).
Sanitization: Absent. There is no mention of filtering or validating content retrieved from external URLs before processing.

devex-review