The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses eval to execute shell commands produced by the gstack-slug binary: eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)". This is a high-risk pattern as it allows arbitrary command execution based on the binary's output.
[COMMAND_EXECUTION]: The skill executes multiple local binaries and scripts within the ~/.claude/skills/gstack/ directory, such as gstack-config, gstack-team-init, and setup.
[REMOTE_CODE_EXECUTION]: The skill synthesizes new TypeScript files (script.ts, script.test.ts) using conversation history and HTML content retrieved from previous /scrape tool calls. It then executes this generated code using the bun runtime (bun test script.test.ts). This creates a significant risk of code injection if the scraped website contains malicious content designed to influence the code generation logic.
[DATA_EXFILTRATION]: The skill accesses sensitive local directories and project files, including ~/.claude/skills/gstack/, ~/.gstack/, .gitignore, and the conversation history (last 10 turns) to extract data for script synthesis.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Since it processes HTML from external websites to 'codify' a scraper, an attacker could embed malicious instructions in a webpage's HTML comments or hidden text. These instructions could trick the agent into generating a script that performs unauthorized actions (like exfiltrating files or environment variables) when the generated test is executed.

skillify