The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically loads Node.js modules using the require function with paths constructed at runtime. Specifically, it loads capability-registry.cjs, surface.cjs, and clusters.cjs from a computed path based on the runtimeConfigDir variable (derived from $HOME/.claude or CLAUDE_CONFIG_DIR).
[INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied arguments for sub-commands such as profile, disable, and enable. These inputs (e.g., profile names or cluster names) are used to modify the agent's runtime environment by determining which skills are enabled. While the documentation describes validation against allowed names, the ingestion of external strings to control active capabilities represents an attack surface.
[COMMAND_EXECUTION]: The skill instructions involve executing shell commands to resolve the environment variable CLAUDE_CONFIG_DIR, check for the existence of configuration files in ~/.claude/, and manage the staging of skill directories located at ~/.claude/skills/gsd-*/.

gsd-surface