The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute various shell commands and local binaries, including git, gh (GitHub CLI), bun, and jq. It specifically invokes binaries located in ~/.claude/skills/gstack/bin/ such as gstack-config, gstack-team-init, and gstack-slug.
[REMOTE_CODE_EXECUTION]: Employs dynamic shell execution via eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)". This pattern executes the output of a local script as shell commands, which can lead to arbitrary code execution if the script output is compromised.
[COMMAND_EXECUTION]: The skill performs state-modifying operations such as adding/committing files to git (CLAUDE.md, .gitignore), deleting directories (.claude/skills/gstack/), and creating marker files in the home directory (~/.gstack/).
[PROMPT_INJECTION]: The 'Skill routing' section provides instructions that attempt to override or influence the agent's decision-making process for tool selection, prioritizing specific skills for certain types of user requests.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and renders untrusted data from external sources.
Ingestion points: Data retrieved from gh pr view and the output of bin/gstack-next-version (cached in /tmp/*.json).
Boundary markers: None; the skill interpolates external data directly into the dashboard output and user suggestions without delimiters.
Capability inventory: Access to git, gh, bun, and jq subprocesses, as well as the ability to modify project files.
Sanitization: No evidence of sanitization or validation of the data retrieved from external tools before it is rendered or used to generate suggestions.

landing-report