The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions command the agent to clone a repository from https://github.com/garrytan/gstack.git and run a ./setup script. Executing scripts from external, unverified sources represents a significant risk as the script's behavior is not constrained or inspected by the skill's static definition.
[DATA_EXFILTRATION]: The skill documentation explicitly states that it sends "the review prompt and the relevant plan or code" to external services such as Codex and OpenAI. While this is a documented feature for obtaining independent reviews or mockups, it involves the transmission of potentially sensitive local project data to external third-party infrastructure.
[COMMAND_EXECUTION]: The skill requires the execution of shell commands during setup that modify the local environment, including building binaries, downloading the Chromium browser, and registering hooks in the agent's configuration settings.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied plans and code as its primary function, creating an attack surface where malicious instructions embedded in those documents could influence the agent's behavior.
Ingestion points: User-provided plans and code snippets processed for design review (SKILL.md).
Boundary markers: None identified in the skill instructions to separate the plan content from the agent's operational instructions.
Capability inventory: The skill utilizes external binaries, network operations for reviews, and environment modifications (SKILL.md).
Sanitization: No evidence of input sanitization or filtering of instructions within the processed data is present.

plan-design-review