The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a package globally using npm install -g gsd-pi. The package source is not recognized as a trusted organization or well-known service, posing a supply chain risk.
[COMMAND_EXECUTION]: The framework's core functionality involve executing arbitrary shell commands specified within PLAN.md files (under the "Must-Haves" section) to verify task completion. While intended for development tasks, this provides a direct path for executing arbitrary commands on the host system.
[DYNAMIC_EXECUTION]: The framework allows the loading and execution of custom TypeScript logic from a local file path (./hooks.ts) defined in a configuration file (.gsd/config.json). This dynamic loading of executable content at runtime is a high-risk pattern if the source file is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from multiple project files to direct the agent's behavior, creating an injection surface.
- Ingestion points: Content is read from PROJECT.md, ROADMAP.md, PLAN.md, RESEARCH.md, and SKILLS.md and injected into the agent's prompts.
- Boundary markers: The skill documentation notes that context is "pre-inlined" into dispatch prompts but does not specify the use of delimiters or instructions to ignore embedded commands within these files.
- Capability inventory: The agent framework possesses extensive capabilities, including full shell command execution, file system modification, git management, and network access.
- Sanitization: There is no evidence of sanitization or validation performed on the markdown content before it is interpolated into the agent's execution context.

gsd-2-agent-framework