The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill frequently uses eval and source on the output of local binaries (such as gstack-slug and gstack-repo-mode) located in ~/.claude/skills/gstack/bin/. This allows the skill to dynamically modify environment variables and the shell state at runtime based on the execution of these scripts.
[DATA_EXFILTRATION]: Repository contents, including implementation plans, design documents, and branch diffs, are sent to external services (OpenAI Codex via the codex CLI) and telemetry servers. While this is part of the skill's primary functionality (the "outside voice" review and usage tracking), it involves exporting potentially sensitive code and project metadata to remote endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill reads and analyzes untrusted data directly from the repository being reviewed, which could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: Files are read via Read, Grep, and Glob tools; repository history and diffs are ingested through Bash commands like git log and git diff.
Boundary markers: The instructions lack consistent boundary markers (e.g., XML tags or clear delimiters) when interpolating file content into prompts for the primary review or the external Codex review.
Capability inventory: The skill has access to powerful tools including Bash (for subprocess execution), Write (for modifying project files and CLAUDE.md), and WebSearch.
Sanitization: There is no evidence of sanitization or escaping of the repository content before it is processed by the LLM or external agents.
[COMMAND_EXECUTION]: The skill executes a wide range of shell commands for project state detection, configuration management, and session handling. This includes interacting with local gstack binaries and performing git operations like git commit and git add.

plan-eng-review