The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses the bash tool to perform project health checks, verify git status, and manage vendor-specific configurations. These operations are restricted to the local environment and the current project directory.
[DYNAMIC_EXECUTION]: In its preamble, the skill employs eval and source on the output of local scripts (e.g., gstack-slug, gstack-repo-mode) located in the vendor's installation directory (~/.claude/skills/gstack/bin/). This is used to load session-specific environment variables and repository settings.
[DATA_EXFILTRATION]: The skill includes an opt-in telemetry system that logs usage statistics and the repository's base name to a remote endpoint. Additionally, it offers a feature to sync project artifacts (plans and designs) to a private GitHub repository. Both features are explicitly presented to the user for approval before activation.
[INDIRECT_PROMPT_INJECTION]: As an analysis skill, it ingests data from external files such as CLAUDE.md, TODOS.md, and project source code. While this represents a potential attack surface for indirect prompt injection, the skill uses this data solely to inform its architectural and quality reviews.
[EXTERNAL_DOWNLOADS]: The skill checks for updates via a local binary and provides links to external documentation (e.g., garryslist.org). It also includes logic to pull cross-machine artifacts from a user-configured remote repository if the sync feature is enabled.

plan-eng-review