The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple local scripts and binaries within the ~/.claude/skills/gstack/bin/ directory using the Bash tool. These include gstack-skill-start for initialization, gstack-learnings-log for recording session insights, and gstack-skill-end for lifecycle completion.
[DYNAMIC_EXECUTION]: The skill dynamically assembles shell commands and JavaScript expressions. It uses bun to run a local TypeScript renderer (gstack-render.ts) and passes logic via the --eval flag, including Base64-encoded user content that is decoded and executed within a browser context.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (English descriptions or Mermaid source) to generate diagrams. While the rendering happens in a local browser context, the lack of strict boundaries for this data creates a potential injection surface.
Ingestion points: Diagram source code and descriptions are ingested directly from user prompts.
Boundary markers: No specific delimiters or safety warnings are used to wrap the untrusted input within the skill's internal logic.
Capability inventory: The skill can execute local Bash scripts, read from the file system, and write artifacts (SVG, PNG, .mmd, .excalidraw) to local or temporary directories.
Sanitization: The skill uses Base64 encoding to transport user-supplied data into the JavaScript environment, which prevents simple shell or string escape attacks but does not mitigate malicious logic within the diagram source itself.
[DATA_EXFILTRATION]: The skill transmits operational metadata (session IDs, success/error outcomes, and 'durable learnings') via the gstack-skill-end and gstack-learnings-log utilities. This behavior is consistent with the vendor's stated telemetry and improvement framework.

diagram