The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-supplied input ($ARGUMENTS as the branch name) directly into multiple shell commands, including git worktree add, git branch, and mkdir -p. The instructions explicitly forbid sanitization ("do not sanitize or replace '/' with '-' or any other character"), which increases the risk of command injection if a branch name contains shell metacharacters (e.g., feature; rm -rf /).
[COMMAND_EXECUTION]: The skill automatically searches for and executes a shell script (dev-wt-ports.sh) found in common project directories like tools/dev/ or scripts/. This execution occurs without explicit user confirmation of the script content, creating a risk of executing malicious code if an attacker can influence the project files.
[EXTERNAL_DOWNLOADS]: The skill invokes various package managers (npm, yarn, pnpm, bun, cargo, pip, poetry) to download and install third-party dependencies based on manifests found in the project. While this is a standard developer workflow, it involves the execution of external code from public registries.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8):
Ingestion points: The branch name is derived from $ARGUMENTS, which may come from untrusted task descriptions or implementation plans. It also reads configuration from .claude/dev-setup.json and CLAUDE.md.
Boundary markers: Absent. There are no instructions to ignore embedded commands within the ingested data.
Capability inventory: The skill has significant capabilities, including shell execution (git, bash), file system modification (mkdir, echo to .gitignore), and network operations (via package managers).
Sanitization: Absent. The skill explicitly instructs the agent not to sanitize the branch name input, and it follows paths from configuration files without further validation.

dev-worktrees