The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill manages optional runtime components via a bootstrap script (runtime-bootstrap.mjs) that downloads archives from the author's official GitHub repository (time-attack/gstack). The process includes integrity verification using SHA-256 and Cosign attestations.
[COMMAND_EXECUTION]: Extensive use of shell commands is employed across all modules for repository management, git operations, and local tool orchestration. This includes spawning agents in isolated worktrees and executing analysis cycles via the gbrain CLI.
[CREDENTIALS_UNSAFE]: The onboarding workflow for the optional gbrain knowledge base collects Supabase Personal Access Tokens and Session Pooler URLs. The skill includes explicit disclosures regarding token scope, handles secrets via memory-only environment variables or secure local files (mode 0600), and provides guidance on revocation.
[DATA_EXFILTRATION]: To mitigate risks when sending data to external models for secondary review, the skill implements a deterministic redaction engine (gstack-redact) that scans for and blocks credentials, PII, and sensitive legal markers. A semantic review pass further audits for confidential internal context and negative judgments against individuals.
[PROMPT_INJECTION]: The skill uses clear instruction boundaries and system prompts to prevent sub-agents from following directives embedded in user-provided data. For example, Codex prompts are prefixed with explicit instructions to ignore SKILL.md files and focus solely on repository code.

plan