The Agent Skills Directory

[SAFE]: The skill is designed for brownfield codebase onboarding, involving mapping and documentation ingestion. All activities described are consistent with this purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from existing codebases via tools like Read, Glob, and Grep, which constitutes a potential injection surface. However, the instructions emphasize using safety gates and interactive handoffs (AskUserQuestion), and the operations are restricted to generating planning artifacts in a local .planning/ directory.
[COMMAND_EXECUTION]: The skill utilizes Bash to perform its mapping and initialization tasks. This access is appropriate for a tool intended to analyze and organize a development project structure.
[DATA_EXPOSURE]: File system access is scoped to the project directory (creating .planning/ files) and internal reference files located at ~/.claude/gsd-core/. No evidence of unauthorized network access or sensitive data exfiltration was found.

gsd-onboard