The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses eval and source to execute the output of local binaries, specifically eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" and source <(~/.claude/skills/gstack/bin/gstack-diff-scope <base> 2>/dev/null). This allows local scripts to dynamically modify the agent's environment or execute arbitrary shell commands.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from git log, gh pr view, and TODOS.md to extract implementation intent and actionable items. There are no explicit boundary markers or sanitization logic defined to prevent malicious instructions within these data sources from influencing the agent's behavior.
[PROMPT_INJECTION]: The skill contains logic to intentionally override standard safety and interaction protocols. If the SPAWNED_SESSION environment variable is set, the agent is instructed to skip AskUserQuestion prompts and auto-choose options, which removes human-in-the-loop oversight.
[COMMAND_EXECUTION]: The skill relies on a wide array of local vendor binaries (e.g., gstack-config, gstack-team-init, gstack-next-version) and third-party tools like codex and bun. The execution of these tools is based on the state of the local environment and project files, which could be manipulated to trigger unintended behavior.

review