The Agent Skills Directory

[COMMAND_EXECUTION]: Command injection vulnerability in the setup logic. The skill instructs the agent to insert user-provided text directly into a shell command (cd "<user-provided-path>") without sanitization, allowing for arbitrary code execution if the input contains shell metacharacters (e.g., backticks or command substitution).
[COMMAND_EXECUTION]: Risky use of eval on script output. The setup process executes eval "$(~/.claude/skills/gstack/bin/gstack-paths)", which interprets the output of the local script as shell commands. This is a dangerous pattern if the target script or its environment is not strictly controlled.
[COMMAND_EXECUTION]: Execution of scripts from relative paths. The skill's hooks reference scripts in sibling directories (../careful/ and ../freeze/) via the ${CLAUDE_SKILL_DIR} environment variable, which relies on a specific and trusted local directory structure.
[COMMAND_EXECUTION]: Ingestion of untrusted data into shell capabilities (Indirect Prompt Injection surface):
Ingestion points: User-supplied path via the AskUserQuestion tool in SKILL.md.
Boundary markers: Absent; the user input is interpolated directly into a bash command string without delimiters or validation instructions.
Capability inventory: Bash tool usage for path resolution and state management.
Sanitization: Absent; the skill does not require the agent to sanitize or validate the user-provided path before execution.

guard