The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Git repository, such as branch names, commit subjects, and diffs, which could potentially contain malicious instructions intended to manipulate the agent's decision-making during triage or maintenance tasks. Ingestion points: The scripts/git_worktree.py script ingests metadata and commit history from the local repository (e.g., in the branch_audits and maintenance_candidates functions). Boundary markers: Instructions in SKILL.md and references/branch-triage.md define a structured workflow, but the prompt templates do not utilize specific delimiters to isolate potentially hostile text found in commit messages or branch names from the agent's instructions. Capability inventory: The skill possesses significant local capabilities, including branch deletion (branch-delete), worktree removal (remove), and code merging (merge), which could be abused if the agent is successfully injected. Sanitization: The script performs standard Git branch name validation but does not sanitize or escape the content of commit messages or code diffs before they are processed by the agent.
[COMMAND_EXECUTION]: The core logic in scripts/git_worktree.py relies on the execution of the git binary to manage repository state. The implementation uses subprocess.run with a list of arguments and shell=False, which follows best practices for preventing command injection. Input parameters such as branch names and paths are either validated against Git's naming rules or derived from existing filesystem paths, minimizing the risk of arbitrary command injection.

git-worktree