The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to clone source code from a personal GitHub repository (https://github.com/garrytan/gstack.git) rather than a trusted organization or official registry.
[REMOTE_CODE_EXECUTION]: The installation process requires executing a setup script (./setup) and a pre-compiled binary (browse/dist/browse) from the external repository, enabling unverified code execution on the host machine.
[CREDENTIALS_UNSAFE]: The /setup-browser-cookies command is designed to extract and import sensitive session cookies from the user's local browser installations (Chrome, Arc, Brave, and Edge) into the assistant's workspace.
[DATA_EXFILTRATION]: By harvesting authenticated session cookies, the skill gains the ability to access private user accounts and sensitive data on external websites without manual login.
[COMMAND_EXECUTION]: The skill extensively uses shell commands for setup (bun install), automated release management (/ship), and repository analysis (/retro).
[INDIRECT_PROMPT_INJECTION]: The toolset provides a significant surface for indirect prompt injection by processing untrusted data from external URLs through the /browse and /qa commands. Ingestion points: Web content is ingested from user-provided or discovered URLs during browser automation and QA testing. Boundary markers: The skill defines no delimiters or instructions to ignore embedded commands in fetched web content. Capability inventory: The skill possesses file write access, network access, and the ability to execute git commands for branch management. Sanitization: No evidence of filtering or sanitization of retrieved web content is provided in the instructions.
[PROMPT_INJECTION]: The skill includes a directive to "Never use mcp__claude-in-chrome__* tools," which attempts to override the agent's default tool selection and safety guardrails.
[PERSISTENCE]: The skill maintains presence by installing itself in the ~/.claude/skills/ directory, ensuring it is loaded across different agent sessions.
[PRIVILEGE_ESCALATION]: The installation instructions require the user to manually grant execution permissions (chmod +x) to downloaded scripts and binaries, escalating their privileges on the host system.

gstack-workflow-assistant