The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses eval and bash -c to execute build and test commands (e.g., BUILD_CMD, TEST_CMD, AUDIT_TEST_CMD) that are dynamically discovered from the repository's configuration files such as Makefile, Justfile, and package.json. Evidence in: references/execute-phase/steps/post-merge-gate.md, references/code-review-fix.md, references/validate-phase.md.
[COMMAND_EXECUTION]: Workflow scripts execute generated JavaScript logic via node -e to handle complex file parsing, YAML processing, and state management within bash environments. Evidence in: references/code-review-fix.md, references/code-review.md.
[REMOTE_CODE_EXECUTION]: The skill's update workflow utilizes npx to download and execute the latest version of the get-shit-done-cc CLI tool from the public npm registry. Evidence in: references/update.md.
[EXTERNAL_DOWNLOADS]: The skill fetches external content including project changelogs from GitHub raw URLs and utilizes web search and Context7 MCP tools for domain research. Evidence in: references/update.md, references/discovery-phase.md.
[PROMPT_INJECTION]: User-supplied descriptions, issue summaries, and descriptions are interpolated into prompts for various sub-agents (e.g., gsd-executor, gsd-planner). While the skill uses XML-like delimiters to isolate this input, it remains an inherent attack surface for indirect prompt injection via project files. Evidence in: references/diagnose-issues.md, references/discuss-phase.md.

gsd-workflows