The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes multiple local binaries from a specific path (~/.claude/skills/gstack/bin/), such as gstack-update-check, gstack-config, and gstack-telemetry-log. These executions are core to the skill's state and configuration management.
[COMMAND_EXECUTION]: The skill utilizes the 'source <(...)' pattern to dynamically execute the output of the gstack-slug binary into the current shell environment, which is a form of dynamic code execution.
[DATA_EXFILTRATION]: The skill implements a telemetry system that logs event data (skill name, duration, outcome) via an external binary (gstack-telemetry-log). Although the skill documentation states this is anonymous and provides an opt-out mechanism, it represents a data transmission flow.
[COMMAND_EXECUTION]: During the pre-review audit, the skill executes broad system commands including git log, git diff, and recursive grep searches through the project directory to gather context.
[INDIRECT_PROMPT_INJECTION]: The skill ingest data from various project files (CLAUDE.md, TODOS.md, architecture docs) to perform its analysis. This creates an attack surface where malicious instructions embedded in project documentation could potentially influence the agent's behavior during the review process.
Ingestion points: Reads CLAUDE.md, TODOS.md, and local architecture documents.
Boundary markers: No explicit boundary markers or isolation instructions are used when reading these files.
Capability inventory: The skill has permissions to execute bash commands, write to the filesystem (~/.gstack/), and perform network operations for telemetry.
Sanitization: No explicit sanitization or filtering of the ingested file content is performed before processing.

plan-ceo-review