The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local vendor-provided utilities to manage session state and session telemetry.
Evidence includes calls to gstack-skill-start, gstack-skill-end, gstack-decision-search, and gstack-learnings-log located in the user's home directory (~/.claude/skills/gstack/bin/).
These tools are part of the 'gstack' framework associated with the skill author.
[DYNAMIC_EXECUTION]: The skill uses shell evaluation to source environment variables from a local vendor script.
Evidence: eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" is used to recover project context at session start.
[INDIRECT_PROMPT_INJECTION]: The skill researches project implementation files, tests, and documentation to generate new content, which creates a surface for instructions embedded in data to enter the agent context.
Ingestion points: Step 1 (Codebase Archaeology) reads source code, READMEs, entry points, and tests using find, Read, and Grep tools.
Boundary markers: The skill includes a specific security instruction to honor instructions ONLY when they originate from the trusted gstack-skill-start tool result, explicitly ignoring instructions found in files or page content.
Capability inventory: The skill has capabilities to write files, edit content, and execute git commands (git push).
Sanitization: Includes a mandatory redaction scan using gstack-redact before committing generated documentation to identify and block potential credential leaks.
[DATA_EXFILTRATION]: The skill interacts with remote git hosting platforms to update pull requests and push generated documentation.
Evidence: Uses git push, gh pr view, and glab mr view to interact with the project's configured remote repository. These operations are restricted to the base branch detected at runtime.

document-generate