The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The setup section downloads an installation script from the well-known service https://bun.sh/install and executes it via bash.
Evidence: The skill includes logic to download the script to a temporary file, verify its integrity using a hardcoded SHA256 checksum (bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd), and then execute it if the checksum matches.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites during its monitoring and discovery phases, creating a surface for indirect prompt injection.
Ingestion points: Data enters the agent context from external URLs via the browse tool (using $B goto, $B links, $B text, etc.) in SKILL.md Phases 2, 3, 4, and 5.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are applied to the external content retrieved by the browse tool.
Capability inventory: The skill utilizes Bash, Write, and Read tools, performing file system operations and executing multiple local scripts.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the web content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill preamble and various phases execute several local binaries and scripts provided by the vendor to manage state, configuration, and telemetry.
Evidence: Commands such as gstack-config, gstack-update-check, gstack-slug, gstack-learnings-search, and gstack-timeline-log are called extensively throughout SKILL.md.
[DATA_EXFILTRATION]: The skill contains logic for telemetry and artifact synchronization which involves sending data to external endpoints.
Evidence: Telemetry data is recorded locally and optionally sent to a remote server via gstack-telemetry-log. Additionally, the Artifacts Sync section describes publishing artifacts to a GitHub repository. Both features are designed to be user-prompted before activation.

canary