The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to systematically explore and interact with arbitrary web applications, creating a vulnerability surface where malicious instructions on a target website could attempt to influence the agent's behavior.
Ingestion points: Untrusted content is ingested from external web pages via the browser tool ($B), including snapshots, links, and console logs (referenced in SKILL.md).
Boundary markers: The skill does not define explicit delimiters or 'ignore embedded instructions' warnings for content read from the browser.
Capability inventory: The skill has high-privilege capabilities including Bash, Write, Edit, and AskUserQuestion (defined in frontmatter and used throughout SKILL.md).
Sanitization: No explicit sanitization or filtering of external website content is mentioned before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill includes a setup routine that downloads the Bun runtime from a well-known service if it is not already installed. This finding is considered safe as it targets an official domain and implements security best practices.
Evidence: The skill downloads the Bun installer from https://bun.sh/install (in SKILL.md).
Security Measure: It performs a mandatory SHA256 checksum verification (actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}')) against a hardcoded hash (bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd) before execution.
[COMMAND_EXECUTION]: The skill frequently executes local helper binaries located in the user's home directory to manage configuration, logging, and updates.
Evidence: The preamble in SKILL.md calls multiple binaries such as gstack-update-check, gstack-config, gstack-timeline-log, and gstack-telemetry-log from ~/.claude/skills/gstack/bin/.
Context: These are considered vendor-owned resources for the 'gstack' project and are consistent with the skill's operational requirements.
[DYNAMIC_EXECUTION]: The skill uses dynamic shell patterns to load configuration and environment settings from its own binaries.
Evidence: SKILL.md contains eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" and source <(~/.claude/skills/gstack/bin/gstack-repo-mode 2>/dev/null).
Context: This is used to dynamically resolve project-specific identifiers and repository modes from the skill's own trusted local tools.

qa