The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's setup script parses CLAUDE.md to extract worktree directory preferences using grep and sed. This represents a vulnerability surface where a malicious repository could include a crafted CLAUDE.md file to influence file system operations.
Ingestion points: CLAUDE.md (parsed in scripts/worktree-setup).
Boundary markers: None present; the script extracts content between quotes or backticks without validation.
Capability inventory: mkdir -p, git worktree add, and various package managers (npm, pip, cargo, etc.) in scripts/worktree-setup.
Sanitization: Absent. The script appends the extracted string to the repository root path without checking for directory traversal sequences (e.g., ../).
[COMMAND_EXECUTION]: The scripts/worktree-setup script executes several commands that modify or interact with the host environment:
Automatic Git Commits: The script automatically adds entries to .gitignore and performs a git commit if the worktree directory is not already ignored. This modifies the repository's permanent history without explicit user confirmation for each commit.
External Test Runner: The script attempts to execute a file at ~/.agents/bin/run-tests. This introduces a dependency on an external, unmanaged binary in the user's home directory.
Package Managers: The script invokes npm install, cargo build, pip install, poetry install, and go mod download. While these are standard development tools, they are capable of executing arbitrary code via post-install scripts or build-time hooks if the repository contains malicious configuration files.

using-git-worktrees