The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/spawn-worker.sh script is vulnerable to command injection. It constructs a shell command string for tmux split-window using single quotes to wrap the $worktree_path variable. If the path contains a single quote followed by shell metacharacters, it allows for arbitrary command execution on the host system. Evidence: "cd '$worktree_path' && $claude_cmd".
[COMMAND_EXECUTION]: The skill programmatically bypasses the 'trust' security prompt in the child agent sessions it creates. It uses tmux capture-pane to detect the trust request and automatically sends an Enter key to accept it without user oversight. This defeats a core safety mechanism intended to prevent unauthorized filesystem access. Evidence: if echo "$content" | grep -qi "trust"; then tmux send-keys -t "$pane_id" Enter ....
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
Ingestion points: GitHub issue content is retrieved via gh issue view and passed directly as instructions to newly spawned agents in SKILL.md.
Boundary markers: The child agents are started in plan mode, which provides some oversight, but the skill's automated trust bypass reduces the user's ability to intervene before the agent acts.
Capability inventory: Child agents possess full filesystem access, network capabilities, and the ability to execute code within the repository worktree.
Sanitization: There is no evidence of sanitization or escaping of the issue title or description before it is passed as a primary instruction to the worker agent.

parallel-develop