The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local binary gstack-model-benchmark located in the vendor-specific directory $HOME/.claude/skills/gstack/bin/.
[DATA_EXFILTRATION]: The skill accesses the sensitive file ~/.claude/.credentials.json and the ANTHROPIC_API_KEY environment variable. While this is used to check provider authentication status for the vendor's own tools, it involves direct access to credential storage.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by ingesting untrusted data from multiple sources: user-provided inline prompts, external files, and local SKILL.md files.
[INDIRECT_PROMPT_INJECTION]: Mandatory Evidence Chain:\n1. Ingestion points: AskUserQuestion tool for inline prompts and file path inputs (Steps 1A, 1B, 1C).\n2. Boundary markers: Absent. Prompts are treated as raw strings for command arguments.\n3. Capability inventory: Shell execution capability through the Bash tool.\n4. Sanitization: Absent. The instructions do not specify any validation, escaping, or sanitization of user-provided prompt text before it is used in a shell command.
[DYNAMIC_EXECUTION]: The skill instructs the agent to construct shell commands via string concatenation of unsanitized user input (e.g., "$BIN" --prompt "<text>"). This creates a significant risk for command injection if the input contains shell metacharacters like backticks, semicolons, or pipe symbols.

benchmark-models