The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the Bun runtime installer from the official bun.sh website if the dependency is not found on the system during the setup process.
[REMOTE_CODE_EXECUTION]: The Bun setup script is executed via a piped bash command (curl | bash), which is a standard installation method for the tool and targets a well-known service domain.
[DATA_EXFILTRATION]: The skill's primary function involves accessing and decrypting local browser cookies from Chromium-based browsers to facilitate authenticated sessions. While this involves sensitive session data, the behavior is the core functionality disclosed to the user.
[COMMAND_EXECUTION]: Several local binaries provided by the gstack toolset (e.g., gstack-config, gstack-telemetry-log) are executed to manage the skill's environment and usage analytics.
[PROMPT_INJECTION]: The instructions contain logic to modify agent behavior based on user-configured flags and state files, such as opting out of proactive suggestions or handling telemetry prompts.
[DATA_EXFILTRATION]: Usage telemetry including skill names and session durations is transmitted to the vendor, subject to user consent obtained through an interactive AskUserQuestion prompt.
[PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted browser cookie data into the agent's context. Ingestion Point: browser profiles referenced in SKILL.md; Boundary Markers: none; Capability: bash execution and interactive prompts; Sanitization: none.

setup-browser-cookies