The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses eval to execute the output of a local script (~/.claude/skills/gstack/bin/gstack-paths) to set up its execution environment. Executing the output of an external script at runtime can be risky as it allows the script to inject arbitrary commands into the current shell context.
[COMMAND_EXECUTION]: The skill defines PreToolUse hooks that automatically execute external bash scripts (check-careful.sh and check-freeze.sh) before the agent can use Bash, Edit, or Write tools. While intended for safety, this establishes a persistent execution pattern where external scripts in sibling directories are run for every command.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to command injection during the setup phase where a user-provided directory path is interpolated into a shell command.
Ingestion points: User input provided through the AskUserQuestion tool for the restriction path.
Boundary markers: None; the path is directly interpolated into a cd command.
Capability inventory: Subprocess calls via Bash tool to resolve paths and write to the state directory.
Sanitization: Absent; the instruction tells the agent to run cd "<user-provided-path>", which could lead to command substitution if the user provides a path containing backticks or $().
[DATA_EXFILTRATION]: The skill collects local analytics including skill name, timestamps, and current repository names, appending them to ~/.gstack/analytics/skill-usage.jsonl. While the data is stored locally, it constitutes tracking of the user's workspace and tool usage habits.

guard