The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/new-lane.sh script automatically copies sensitive environment and secret files, specifically .dev.vars, .env, .env.local, .env.development, and .secrets, from the repository root to newly created worktree directories. While this functionality is intended to ensure that new development environments are immediately functional, it increases the footprint of credentials on the local filesystem and could lead to accidental exposure if worktrees are created in less secure locations (e.g., when using the --sibling flag to place them outside the project root).
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from Git repositories—including branch names, commit messages, and Pull Request descriptions—which are then used to construct prompts for a background sub-agent (git-agent). Maliciously crafted Git metadata could potentially influence the behavior of the agent during write operations.
Ingestion points: scripts/status.sh, scripts/worktree-survey.sh, and scripts/land-all.sh read Git repository state, metadata, and commit history.
Boundary markers: The skill uses Markdown headers (e.g., ## Context, ## Operation) within its dispatch templates to separate instructions from external context.
Capability inventory: The agent has the capability to execute shell commands, perform Git operations, create/remove worktrees, and copy files.
Sanitization: While the scripts/new-lane.sh script sanitizes the branch slug, commit messages and PR metadata are processed and interpolated into agent prompts without significant sanitization or escaping.

git-ops