The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's setup instructions direct the agent to interpolate user-provided text directly into a shell command.
Ingestion points: User input provided via the AskUserQuestion tool regarding the directory path to restrict edits to.
Boundary markers: None identified; the instructions do not specify delimiters or warnings to ignore embedded commands in the user input.
Capability inventory: The skill uses the Bash tool to resolve paths, create directories, and write state files. It also uses eval for dynamic execution.
Sanitization: There is no evidence of sanitization or escaping (e.g., using printf %q) before the user input is placed inside the cd "<user-provided-path>" command, creating a command injection surface if the agent does not manually sanitize the input.
[DYNAMIC_EXECUTION]: The skill uses eval to execute the output of a local script to resolve environment paths.
Evidence: eval "$(~/.claude/skills/gstack/bin/gstack-paths)" is used in the directory resolution logic in SKILL.md to establish the $GSTACK_STATE_ROOT environment variable.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its primary logic and state management.
Evidence: Uses PreToolUse hooks to execute bash ${CLAUDE_SKILL_DIR}/bin/check-freeze.sh whenever the Edit or Write tools are invoked.
Evidence: Records usage telemetry (skill name, timestamp, and repository name via git rev-parse) to a local file at ~/.gstack/analytics/skill-usage.jsonl.

freeze