The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external files (design docs and plans) that are not under its direct control.
Ingestion points: The skill reads design documentation from ~/.gstack/projects/ and project plan files provided within the conversation context.
Boundary markers: No specific delimiters or security instructions are used to prevent the agent from following directions that might be embedded within the files being reviewed.
Capability inventory: The skill has extensive permissions, including the ability to execute shell commands (Bash), write to the filesystem (Write), and perform web searches.
Sanitization: Content retrieved from the design and plan files is not sanitized or validated for embedded instructions before being processed by the agent.
[COMMAND_EXECUTION]: The skill uses the Bash tool to interact with the local environment and manage its internal toolset.
It executes various local binaries and shell scripts located in ~/.claude/skills/gstack/bin/ to manage configuration, telemetry, and software updates.
It conditionally executes the codex utility (if available in the environment) to perform automated critiques of implementation plans using an external analysis tool.

plan-eng-review