The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses ~/.claude.json, a sensitive configuration file for the Claude CLI that may contain session tokens or credentials. It also implements telemetry logging and an opt-in feature to sync project artifacts (plans, designs, and reports) to a remote GitHub repository.
[REMOTE_CODE_EXECUTION]: The skill automatically extracts and executes the test script from the project's package.json file. This behavior allows a malicious repository to execute arbitrary code on the user's system when a health check is invoked.
[COMMAND_EXECUTION]: The skill makes extensive use of local binaries and shell scripts (located in ~/.claude/skills/gstack/bin/) to manage project state, track telemetry, and perform repository analysis.
[DYNAMIC_EXECUTION]: Uses eval and shell source on the output of internal binaries (gstack-slug, gstack-repo-mode) to dynamically configure the environment and influence the agent's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection. Ingestion points: Untrusted data is read from package.json, CLAUDE.md, and the output of various external tools (linters, testers). Boundary markers: There are no delimiters or instructions used to prevent the agent from obeying instructions embedded in tool outputs. Capability inventory: The skill uses Bash for command execution, modifies files like CLAUDE.md, and performs git commit operations. Sanitization: No escaping or validation is applied to external content before it is incorporated into the session context.

health