The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's preamble frequently uses eval and source <(command) patterns to execute the output of binaries located in ~/.claude/skills/gstack/bin/. Examples include eval "$(~/.claude/skills/gstack/bin/gstack-slug)" and source <(~/.claude/skills/gstack/bin/gstack-repo-mode). This allows the binaries to inject arbitrary environment variables or shell logic directly into the agent's current process.
[REMOTE_CODE_EXECUTION]: The skill includes mechanisms for self-updates and syncing "artifacts" (plans, designs) with remote repositories. Specifically, gstack-brain-sync performs git fetch and git merge operations, and gstack-update-check runs at skill start. If the remote source or binary is compromised, these operations facilitate remote code execution on the user's machine.
[DATA_EXFILTRATION]: The skill is designed to collect and send telemetry data via gstack-telemetry-log and sync project artifacts (like CEO plans and designs) to external GitHub repositories via gstack-brain-sync. While the skill includes prompts to ask the user for permission, these features establish the capability to move local project data to external servers.
[COMMAND_EXECUTION]: The skill modifies the local repository's CLAUDE.md file to inject "Skill routing" rules and automatically commits these changes using git commit. This persistence mechanism ensures the skill is proactively suggested or invoked in future sessions, modifying the intended behavior of the agent for that project.
[EXTERNAL_DOWNLOADS]: The skill references and potentially opens external URLs such as https://garryslist.org/posts/boil-the-ocean and interacts with external Git hosts for syncing functionality.

investigate