The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to execute a shell script found within the repository being analyzed ($REPO_ROOT/.claude/worktree-setup.sh).
Evidence: If .claude/worktree-setup.sh exists, the skill executes it using bash with the worktree as the current working directory.
Risk: An attacker can include a malicious script in a repository or Pull Request that will execute arbitrary commands on the user's machine when the /branch command is invoked.
[COMMAND_EXECUTION]: The skill executes an external shell script located in the user's home directory.
Evidence: COORD_DIR=$(bash ~/.claude/coordination/resolve-coord-dir.sh)
Risk: The skill relies on the existence of a specific script outside its own package, which could be subverted or may not be present.
[COMMAND_EXECUTION]: The skill generates and executes shell commands using variables derived from the repository environment.
Evidence: Commands like git worktree add "$WORKTREE_PATH" -b "$SLUG" "$BASE_BRANCH" and directory creation logic.
Risk: While the SLUG variable is validated with a regex, other variables like WORKTREE_PATH (derived from REPO_ROOT and REPO_NAME) could potentially be manipulated in complex environments.
[EXTERNAL_DOWNLOADS]: The skill suggests running package managers to install dependencies during the setup phase.
Evidence: The documentation mentions running npm install as part of a scaffold or within the worktree-setup.sh script.
Risk: This facilitates the download and execution of third-party code from external registries.

branch