The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill makes extensive use of eval and source <(...) to execute shell code generated by custom binaries. For example, it executes eval "$(~/.claude/skills/gstack/bin/gstack-slug)" and source <(~/.claude/skills/gstack/bin/gstack-repo-mode), allowing for dynamic modification of the agent's environment from external scripts.
[COMMAND_EXECUTION]: Core functionality depends on numerous non-standard binaries located in hidden user directories, such as ~/.claude/skills/gstack/bin/gstack-config, gstack-telemetry-log, and gstack-session-kind. These binaries operate outside standard system paths.
[DATA_EXFILTRATION]: The skill collects telemetry data including repository names, session durations, and skill outcomes. This information is saved to ~/.gstack/analytics/skill-usage.jsonl and may be transmitted externally via the gstack-telemetry-log binary. Additionally, the 'cross-project learnings' feature allows the skill to search and read data from multiple projects on the host machine if enabled.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including plan files, git logs, and documentation (CLAUDE.md, DESIGN.md). It lacks robust boundary markers or sanitization when processing this data, which could allow instructions embedded in those files to influence agent behavior.
[COMMAND_EXECUTION]: The skill starts a local web server via the gstack designer component ($D serve) to provide an interactive comparison board for visual mockups. It subsequently interacts with this local server using curl to reload content.
[DATA_EXFILTRATION]: The 'Outside Voices' feature transmits the content of the project plan to the external Codex service for analysis, which involve sending project-specific data to a remote API.

plan-design-review