The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a wide range of local binaries located in ~/.claude/skills/gstack/bin/ to manage configurations, telemetry, and project state (e.g., gstack-config, gstack-telemetry-log, gstack-learnings-search).
[REMOTE_CODE_EXECUTION]: Utilizes dynamic shell execution via eval and source on the output of local binaries like gstack-slug and gstack-repo-mode to configure the environment at runtime.
[REMOTE_CODE_EXECUTION]: Implements a dynamic upgrade mechanism that reads instructions from a local file (~/.claude/skills/gstack/gstack-upgrade/SKILL.md) and follows them if an update is available.
[DATA_EXFILTRATION]: Includes an opt-in telemetry feature that transmits skill usage statistics and session metadata via the gstack-telemetry-log utility.
[DATA_EXFILTRATION]: Features an optional 'Artifacts Sync' capability that synchronizes project artifacts (plans, designs, and reports) to a private GitHub repository for cross-machine indexing.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it ingest untrusted data from git diff, git log, and gh pr view and processes them with high-privilege tools (Bash, Write, Agent) without explicit delimiters or instructions to ignore embedded commands within the analyzed code.
[EXTERNAL_DOWNLOADS]: Performs git fetch and git merge operations on the ~/.gstack directory to synchronize local artifacts with a remote repository as part of its 'Artifacts Sync' feature.

review