The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes various package manager commands such as npm install, cargo build, pip install, poetry install, and go mod download. These tools frequently support lifecycle hooks (e.g., preinstall or postinstall scripts in package.json) that allow for arbitrary shell command execution during the setup phase.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow depends on reading and acting upon content from the repository, including branch names and project configuration files. A malicious repository could craft these inputs to manipulate the agent's behavior during workspace initialization.
Ingestion points: Project configuration files (package.json, Cargo.toml, requirements.txt, pyproject.toml, go.mod), branch names, and workspace preference files (CLAUDE.md).
Boundary markers: None present; the instructions do not include delimiters or warnings to ignore instructions embedded within the files being processed.
Capability inventory: File system modification (mkdir, git worktree add), command execution (npm, pip, cargo, go), and repository state modification (git commit).
Sanitization: No validation or sanitization is performed on the content of the configuration files or branch names before they are passed to shell commands.
[EXTERNAL_DOWNLOADS]: The skill triggers the download of external dependencies from well-known public registries (such as npmjs.com or pypi.org) during the npm install or pip install steps. While the registries themselves are well-known services, the process is vulnerable to dependency confusion or typosquatting if the repository specifies malicious package names.

using-git-worktrees