The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Bun runtime installer from https://bun.sh/install, which is a well-known service for JavaScript development tools.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded Bun installation script. This finding is considered safe as the skill implements a security best practice by calculating the SHA-256 checksum of the downloaded file and verifying it against a hardcoded hash (bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd) before execution.
[DATA_EXFILTRATION]: The skill collects telemetry data including skill usage, duration, and session IDs. This behavior is documented as being gated by a user consent prompt (AskUserQuestion) during the first run, allowing users to opt into community, anonymous, or fully-off modes.
[COMMAND_EXECUTION]: The skill uses extensive shell scripting for session management, state tracking, and invoking local binaries associated with the gstack platform. It also interacts with the project's CLAUDE.md to add routing rules, but only after prompting the user for permission.

benchmark