The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to manage agents that ingest external, potentially untrusted data from git repositories and GitHub pull request comments.
Ingestion points: Agents read repository source code, git logs, and GitHub PR feedback via endpoints like repos/O/R/pulls/N/comments (mentioned in SKILL.md).
Boundary markers: The brief-skeleton.md template attempts to set boundaries using instructions such as "Read this file completely before touching anything" and "Touch only {{your area}}."
Capability inventory: Subagents are expected to have shell access for git operations, build systems (e.g., make, poetry), and file system access within their worktrees.
Sanitization: There is no evidence of automated sanitization or filtering of external content before it is processed by the agents.
[DATA_EXPOSURE]: The template references/brief-skeleton.md (section 0g) instructs subagents to source a sensitive file: source ~/.credentials. While it includes a warning not to print keys, providing an AI agent with direct access to a centralized credentials file increases the risk of accidental exposure or exfiltration if the agent is compromised by indirect injection.
[COMMAND_EXECUTION]: The skill facilitates extensive shell command execution including git manipulation, build processes, and system monitoring (e.g., pkill, du, nohup). This is necessary for the skill's primary purpose but represents a significant capability for subagents to manage.
[EXTERNAL_DOWNLOADS]: The brief-skeleton.md template includes instructions for agents to perform remote operations such as git clone {{submodule-url}}, which downloads external code into the agent's environment at runtime.

worktree-subagents