The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates reviewing external code from pull requests and forks, which serves as an ingestion point for untrusted data into the agent context. Instructions in SKILL.md and references/workflow-examples.md describe fetching remote heads into local worktrees. To mitigate this risk, the skill enforces strict boundaries for 'untrusted bases,' such as preventing environment file copying and recommending that the agent ignore lifecycle scripts during dependency installation.
[EXTERNAL_DOWNLOADS]: The skill automates the installation of dependencies (e.g., npm install, pip install -e .) upon worktree creation. This involves executing external code from package registries. The skill mitigates risks by instructing the agent to disable lifecycle scripts (--ignore-scripts, --no-plugins) when working with code from third-party or origin-only branches.
[DATA_EXFILTRATION]: The worktree-manager.sh script automates the access and copying of sensitive .env files from the main project directory. While this is a localized operation, it handles project credentials. The script implements a safety check to ensure that .env files are only copied to worktrees based on 'trusted' local or default branches, preventing the exposure of secrets to checkouts containing unverified external code. Additionally, the script checks for symlinks and non-regular files to prevent path traversal or redirection attacks during the copy process.

git-worktree