The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes several local helper scripts and binaries (e.g., gstack-gbrain-detect, gstack-gbrain-install, gstack-gbrain-repo-policy) located in the ~/.claude/skills/gstack/bin/ directory. These scripts are part of the author's established framework and are used to detect environment state and manage the tool's lifecycle.
[COMMAND_EXECUTION]: Employs the eval command to execute code generated by the gstack-slug local script. This is used to dynamically set environment variables relevant to the current project context.
[DATA_EXFILTRATION]: Performs network requests to the Supabase Management API (api.supabase.com) to provision or clean up database projects. This is a primary function of the skill and involves a well-known service; credentials (PAT) are collected from the user at runtime and are not persisted to disk.
[COMMAND_EXECUTION]: During the registration of the remote MCP server, a bearer token is passed as a command-line header to the claude mcp add command. The skill explicitly discloses to the user that this practice results in a momentary exposure of the token in the system's process list (argv).
[SAFE]: The skill includes an 'Indirect Prompt Injection' surface as it ingests data from local script outputs and git remotes. However, it mitigates risks by parsing data using structured formats (JSON via jq) and providing clear redaction/disclosure to the user during secret collection.

setup-gbrain