The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's preamble uses eval and shell sourcing (e.g., source <(command)) to load configuration and state from local helper scripts such as gstack-slug and gstack-repo-mode. While these scripts are part of the skill's own binary directory, dynamic execution of script output is a potential risk factor used for environment setup.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands via the Bash tool to perform stack detection, attack surface mapping, and vulnerability scanning. This includes sensitive file operations (mkdir, rm, touch), repository analysis (git log, git ls-files), and the execution of various local binaries (prefixed with gstack-) stored in the skill's installation path.
[DATA_EXFILTRATION]: The skill collects and sends telemetry data, including the skill name, execution duration, repository name, and session ID, to an external service via the gstack-telemetry-log binary. This behavior is presented to the user during the first run and can be configured or disabled through the gstack-config tool.
[INDIRECT_PROMPT_INJECTION]: By scanning potentially untrusted external content such as third-party code, git history, and other AI agent skills, the agent is exposed to indirect prompt injection. The skill mitigates this through a specific 'Anti-manipulation' instruction that directs the agent to ignore any instructions found within the audited codebase that attempt to influence the audit process.

cso