The Agent Skills Directory

[DATA_EXFILTRATION]: The skill captures the repository name using git rev-parse --show-toplevel in the preamble and logs it to ~/.gstack/analytics/skill-usage.jsonl. This directly contradicts the text provided to the user in the telemetry opt-in section, which claims: "No code, file paths, or repo names are ever sent."
[COMMAND_EXECUTION]: The skill executes multiple local binaries and shell commands during its lifecycle, including gstack-update-check, gstack-config, gstack-telemetry-log, and gstack-review-log. These binaries are located in ~/.claude/skills/gstack/bin/ and are not provided as part of the skill source.
[EXTERNAL_DOWNLOADS]: The skill performs an update check via a background binary and directs the user to open external documentation at https://garryslist.org/posts/boil-the-ocean using the open command.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted project data and plan files to drive its review and edit logic.
Ingestion points: Reads plan files, git log output, git diff output, CLAUDE.md, and DESIGN.md.
Boundary markers: Absent; the skill does not use specific delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: Has access to Edit (file modification), Bash (command execution), Read, Grep, and Glob.
Sanitization: None detected; external file content is processed and used to suggest plan improvements and logic changes without validation.

plan-design-review