The Agent Skills Directory

[COMMAND_EXECUTION]: The create <name> command is vulnerable to shell injection. It takes the <name> parameter from $ARGUMENTS and interpolates it into the shell command git worktree add -b worktree-<name> ~/Documents/<repo>-<name> <base-branch> without quoting or sanitization. A malicious input like my-worktree; rm -rf ~ would result in execution of unintended commands.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via manipulated Git metadata.
Ingestion points: Branch names and directory paths are read from git worktree list --porcelain and gh pr list in SKILL.md.
Boundary markers: No boundary markers or instructions to ignore embedded commands are present when processing this data.
Capability inventory: The agent has the capability to run du -sh, git worktree remove, and git branch -d based on the ingested data.
Sanitization: There is no shell-escaping or validation performed on the branch names or paths before they are used as arguments in shell commands.
[COMMAND_EXECUTION]: The cleanup and status routines use unquoted variables derived from external tool output (branch names and paths) in commands such as du -sh <path> and test -d <path>. This allows maliciously named branches or directories to execute arbitrary shell code.
[EXTERNAL_DOWNLOADS]: The skill uses the gh CLI to fetch pull request metadata from GitHub. This is a neutral observation of the skill's intended functionality to monitor PR status.

worktree