The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local utility scripts provided by the vendor for lifecycle management and telemetry. Specifically, it runs gstack-skill-start for initialization, gstack-skill-end for telemetry and cleanup, and gstack-learnings-log for operational logging, all located within the ~/.claude/skills/gstack/bin/ directory.
[DYNAMIC_EXECUTION]: The skill uses a browser daemon to execute JavaScript logic (window.__renderMermaid, window.__mermaidToExcalidraw, etc.) within a browser tab. The rendering engine is loaded from a local HTML bundle (diagram-render.html) found via computed paths at runtime. It also dynamically generates JavaScript calls by embedding base64-encoded user content into JS execution templates.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user input in the form of English descriptions or mermaid source code.
Ingestion points: User descriptions and mermaid source code are accepted as input and written to files (.mmd) before processing.
Boundary markers: The skill does not explicitly use boundary markers when writing the mermaid source to files, although it uses base64 encoding during the transport to the browser engine to mitigate interpretation issues.
Capability inventory: The skill utilizes Bash for shell execution, Write for artifact creation, and browser orchestration for dynamic rendering.
Sanitization: The skill employs base64 encoding and decodeURIComponent(escape(atob(...))) to safely transport user-provided content into the JavaScript rendering environment, preventing direct injection of control characters or script tags during the command generation phase.

diagram