The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Fetches and executes an installation script from the official Bun runtime repository (https://bun.sh/install). The script is saved to a temporary file and executed via bash. A security verification step is performed where the script's SHA256 checksum is compared against a hardcoded hash to ensure the integrity of the downloaded content.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites via web search and an automated browsing tool to perform design audits and AI slop detection. This ingested content influences the generation of code fixes and repository commits.
Ingestion points: WebSearch results, browsing tool output (DOM structure, style computations, and screenshots), and external design critique from Codex.
Boundary markers: Missing; the skill does not explicitly delimit or sanitize design findings before processing them for code generation.
Capability inventory: File system access (Read, Write, Edit), shell command execution (Bash), and git operations (add, commit, revert).
Sanitization: Findings from external web content are translated directly into source code modifications without visible escaping or validation layers.
[DYNAMIC_EXECUTION]: Employs the eval command and process substitution to execute the output of locally installed binaries located in the vendor's application directory (~/.claude/skills/gstack/bin/).
[DATA_EXFILTRATION]: Records usage telemetry including skill name, execution duration, operation outcomes, and the local repository name. Data is saved in a local analytics file and transmitted to a remote telemetry logging service if the user has opted in.
[EXTERNAL_DOWNLOADS]: Downloads project configuration and runtime dependencies from the Bun service and potentially identifies missing browser tools during the setup phase.
[COMMAND_EXECUTION]: Regularly executes shell commands to perform environmental checks, git tree analysis, and local file management using the Bash tool.

design-review