The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions provide a template for resolving a user-provided directory path by interpolating it directly into a shell command substitution: FREEZE_DIR=$(cd "<user-provided-path>" 2>/dev/null && pwd). This is a high-risk command injection surface. If a user provides input such as \"; malicious_command; #, the agent would execute the malicious command. There are no instructions provided to the agent to sanitize or validate this input before execution.
[REMOTE_CODE_EXECUTION]: The skill utilizes the eval command to execute the output of a local script: eval "$(~/.claude/skills/gstack/bin/gstack-paths)". Executing the output of a script via eval is a dangerous dynamic execution pattern that assumes the script and its output are safe from tampering.
[COMMAND_EXECUTION]: The skill performs telemetry logging to a local file (~/.gstack/analytics/skill-usage.jsonl) using shell commands (mkdir, echo, date, git). This demonstrates a pattern of unnecessary shell execution for simple logging tasks.
[COMMAND_EXECUTION]: Indirect Prompt Injection Surface Analysis: 1. Ingestion point: User input for directory path via AskUserQuestion. 2. Boundary markers: None present in the instructions or state management. 3. Capability inventory: mkdir, echo, git, cd, pwd, eval, bash across all operational steps. 4. Sanitization: No sanitization, escaping, or validation of the user-provided path is specified in the instructions before it is used in a shell environment.

freeze