The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute system commands including git (for branch and worktree management), mkdir (for directory structure setup), and uv (for Python environment synchronization). These are core to the skill's functionality but involve significant system interaction.
[DATA_EXFILTRATION]: Step 6 of the skill instructions specifically suggests symlinking .env files and other potentially sensitive assets (like local settings) into new worktrees. While a common development practice, this creates a surface for sensitive credential exposure if the worktree environment is misconfigured, shared, or if the linking process is manipulated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the .worktree-links configuration file (Category 8). An attacker-controlled repository could provide a malicious .worktree-links file that instructs the agent to symlink sensitive files from outside the repository (e.g., SSH keys or global configurations) into the research workspace.
Ingestion points: The agent reads relative paths from the .worktree-links file within the repository (SKILL.md, Step 6).
Boundary markers: There are no markers or instructions provided to the agent to validate or ignore malicious paths within the .worktree-links file.
Capability inventory: The agent has Bash, Write, and Read capabilities, allowing it to create symlinks and access the resulting linked files.
Sanitization: The instructions lack explicit sanitization or path validation logic to ensure that symlink targets are restricted to the project scope.

new-workspace