The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via project-level configuration files which can lead to unauthorized code execution.
Ingestion points: The scripts/create-worktree.sh script reads command strings from the .catalyst/config.json file found within the target repository being processed.
Boundary markers: Absent. There are no delimiters or instructions provided to the agent to ignore or sanitize commands embedded in the configuration file.
Capability inventory: The skill can execute arbitrary shell commands via eval, perform network operations (e.g., git fetch, npm install), and modify sensitive local configuration files such as ~/.claude.json.
Sanitization: Absent. The script performs simple variable substitution (e.g., ${WORKTREE_PATH}) before passing the entire configuration string to eval for execution.
[COMMAND_EXECUTION]: The skill performs command executions that explicitly bypass security oversight.
Evidence: In SKILL.md, the instructions for launching an implementation session include the use of the --dangerously-skip-permissions flag. This flag is designed to suppress the agent's interactive security prompts and permission checks.
Evidence: The scripts/create-worktree.sh script utilizes the eval command within the run_hook_array function to execute arbitrary setup hooks defined in the catalyst.worktree.setup configuration key.
Evidence: The scripts/lib/claude-json-mutate.sh script is used to programmatically modify ~/.claude.json to mark project directories as trusted (hasTrustDialogAccepted: true), which bypasses the manual trust verification process typically required by the platform.
[EXTERNAL_DOWNLOADS]: The skill triggers the download and installation of external packages based on repository content.
Evidence: scripts/create-worktree.sh automatically detects the presence of package.json or bun.lock and executes npm install or bun install accordingly.

create-worktree