The Agent Skills Directory

[COMMAND_EXECUTION]: The worktree::land function accepts an optional test_cmd parameter that is executed via the shell::exec tool. This allows for the execution of arbitrary shell commands within the agent's environment, creating a high-risk vector for unauthorized command execution.
[CREDENTIALS_UNSAFE]: The skill includes a provision.copy_ignored configuration that, when enabled, automatically replicates git-ignored files (specifically mentioning .env files) from the base repository into every new worktree. This practice increases the exposure surface of sensitive credentials and secrets normally kept out of version control.
[DATA_EXFILTRATION]: While the skill description claims it does not push to remotes, the combination of accessing sensitive .env files and the ability to execute network-capable commands via test_cmd provides a direct path for data exfiltration.
[PROMPT_INJECTION]: The skill ingests untrusted data from remote repositories and GitHub pull requests, creating a surface for indirect prompt injection.
Ingestion points: Remote git references and GitHub Pull Request content fetched by worktree::create.
Boundary markers: The skill lacks explicit delimiters or instructions to the agent to disregard instructions embedded within the fetched repository data.
Capability inventory: Includes arbitrary command execution (shell::exec), git mutations, and filesystem operations.
Sanitization: There is no evidence of validation or sanitization performed on the content of the remote branches or PRs before they are checked out.

worktree