The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to use user-supplied arguments (workspace name and target path) directly in shell commands such as mkdir and cp. Without explicit instructions for the agent to sanitize or escape these strings, there is a risk of command injection if a user provides a workspace name containing shell metacharacters (e.g., ;, &&, |).
Evidence: The mkdir -p <target-parent>/<workspace-name> and cp -r ... <target-parent>/<workspace-name>/ commands in Step 4 depend on unsanitized user input from $ARGUMENTS.
[DATA_EXFILTRATION]: The skill is configured to default to creating public GitHub repositories via the gh repo create command. This represents a data exposure risk, as identity facts extracted from ~/.claude/CLAUDE.md (Step 3) are embedded into the workspace and subsequently published to the internet unless the user explicitly provides the --private or --local-only flags.
Evidence: Step 7 instructions specify: gh repo create <workspace-name> --<public|private> --source=. --push, where public is the default behavior stated in the arguments section.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external input and uses it to perform high-capability operations, creating a vulnerability surface for injection attacks.
Ingestion points: User-supplied strings in $ARGUMENTS and local identity/environment facts in ~/.claude/CLAUDE.md (SKILL.md).
Boundary markers: None present; the instructions do not specify delimiters or warnings to ignore instructions embedded in the user-supplied strings.
Capability inventory: The skill uses mkdir, cp, git init/add/commit, and gh repo create (CLI tools with shell access).
Sanitization: Absent; there is no instruction to validate, filter, or escape the workspace name or path before passing them to the shell.

new-workspace