The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several local scripts and binaries located in ~/.claude/skills/gstack/bin/, including gstack-paths, gstack-config, gstack-codex-probe, and gstack-review-log. These appear to be part of the vendor's internal support framework.
[COMMAND_EXECUTION]: Uses eval to execute the output of ~/.claude/skills/gstack/bin/gstack-paths to resolve runtime environment variables like $PLAN_ROOT and $TMP_ROOT.
[COMMAND_EXECUTION]: Sources shell code from ~/.claude/skills/gstack/bin/gstack-codex-probe to perform authentication checks and version validation for the Codex CLI.
[EXTERNAL_DOWNLOADS]: Recommends the installation of the @openai/codex global NPM package if the binary is missing, providing a link to the official OpenAI GitHub repository.
[DATA_EXFILTRATION]: The skill's primary function involves sending project data (git diffs and the full contents of plan files) to an external service (OpenAI) via the codex CLI for analysis. This behavior is transparently documented and aligned with the skill's purpose.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from git diff and plan files. To mitigate this, the skill implements a 'Filesystem Boundary'—explicit instructions to the AI to ignore instructions found in those files—and uses DIFF_START/DIFF_END delimiters to wrap adversarial content.
Ingestion points: Git diffs (Step 2A, 2B) and plan files (Step 2C).
Boundary markers: Includes DIFF_START/DIFF_END delimiters and explicit 'filesystem boundary' instructions.
Capability inventory: Uses Bash for shell execution and the Write tool to update plan files.
Sanitization: Relies on instructional constraints and delimiters rather than programmatic sanitization.

codex