The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The Bash shim used throughout the skill prioritizes execution of gsd-tools.cjs from the current project's root directory (gsd-core/bin/gsd-tools.cjs) before checking system PATH or home directory configurations. This allows a malicious repository to supply a compromised version of the tool that will be executed by the agent upon any skill invocation.- [COMMAND_EXECUTION]: In Step 2a (Query), user input for the parameter is interpolated directly into a shell command. If the user input contains shell metacharacters (e.g., ;, &, |), it could lead to the execution of arbitrary commands.- [EXTERNAL_DOWNLOADS]: The skill documentation and error messages suggest installing core components via npx from @opengsd/gsd-core. This is a vendor-owned resource but involves downloading and executing code from an external registry.- [DATA_EXFILTRATION]: This skill possesses a significant indirect prompt injection surface (Category 8). It performs complex processing on untrusted project files and configuration, while also having the capability to execute shell commands and modify files.
Ingestion points: Reads project-local .planning/config.json and invokes graph building tools on the entire project directory.
Boundary markers: No delimiters are used when processing project data or displaying query results.
Capability inventory: Extensive use of Bash for file operations (cp, timeout), version control (git), and executing JavaScript via node.
Sanitization: There is no evidence of sanitizing user-provided arguments before they are interpreted by the shell environment.

gsd-graphify