The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a mechanism to follow dynamic instruction blocks (GSTACK_INSTRUCTION_BEGIN) provided by the gstack-skill-start binary at runtime, allowing for session-specific onboarding and consent directives.
[DYNAMIC_EXECUTION]: The skill uses the Aside tool to execute repl scripts, automating actions in the user's browser for third-party site configurations.
[DATA_EXFILTRATION]: Technical specifications are sent to an external quality review service (codex) and to GitHub via the gh CLI. Telemetry regarding user selections, skill outcomes, and durable engineering decisions is sent to vendor-specific logging tools (gstack-question-log, gstack-skill-end, gstack-decision-log).
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local codebase (via Read, Grep, Glob) and external GitHub issue titles, which are interpolated into prompts for the agent and the external reviewer. This attack surface is mitigated by the gstack-redact secret scanner and a dedicated semantic review phase.
Ingestion points: Codebase files and GitHub issue titles (gh issue list).
Boundary markers: The quality gate uses explicit markers (<<<USER_SPEC>>> and <<<END_USER_SPEC>>>) to delimit untrusted data.
Capability inventory: The skill possesses extensive capabilities including shell command execution (Bash), browser automation (Aside), GitHub API interaction (gh), and sub-agent spawning (claude -p).
Sanitization: Implements gstack-redact for secret/PII scanning and a SEMANTIC_REVIEW phase to detect malicious intent or sensitive context bleed.
[COMMAND_EXECUTION]: The skill executes multiple local binaries from the vendor's toolchain (e.g., gstack-redact, gstack-post, gstack-paths) to manage its lifecycle, security scanning, and repository interactions.
[EXTERNAL_DOWNLOADS]: The skill recommends manual download and installation of external tools from aside.com and cli.github.com if they are missing.
[REMOTE_CODE_EXECUTION]: The skill can spawn a new agent (claude -p) in a fresh worktree to implement the generated spec and uses the external codex model to perform automated quality reviews on generated content.

spec