The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to search for and copy sensitive environment configuration files (.env.local) when creating new git worktrees. While this is intended to maintain local development environments, it involves the agent reading and duplicating files that typically contain secrets.
Evidence: The file references/worktree-workflow.md contains instructions for 'Env file carry-over', specifically recommending the use of rsync or similar discovery commands to copy .env* files into new directories.
[INDIRECT_PROMPT_INJECTION]: The skill implements an automated 'Worktree Summary' feature that parses git history, diffs, and PR metadata to generate 'Safe to Delete' verdicts. This creates a surface where an attacker could influence the agent's behavior by placing malicious instructions within commit messages, file contents, or GitHub PR descriptions.
Ingestion points: git log, git diff, git status, and gh pr list --json (found in references/worktree-summary.md).
Boundary markers: No specific delimiters or safety warnings are instructed for the parsing of this external content.
Capability inventory: The skill possesses the ability to delete branches (git branch -d) and remove worktrees (git worktree remove), which are the recommended actions based on the automated analysis.
Sanitization: No sanitization or filtering of commit messages or diff content is specified before the agent evaluates the 'verdict'.

git