The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands for repository inspection, Git worktree management, and process monitoring (e.g., git worktree, lsof). These commands are necessary for its functionality but run with the agent's privileges in the current workspace.
[DATA_EXFILTRATION]: The skill explicitly searches for and copies .env.local files across the filesystem. Accessing paths associated with credentials is a sensitive operation. The skill includes mitigations by instructing the agent to never print the values of these files and to specifically exclude production-related environment files.
[EXTERNAL_DOWNLOADS]: The skill triggers bun install, which downloads third-party dependencies from external registries. This is standard for local development but relies on the security of the supply chain and the repository's own dependency configuration.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection by processing untrusted repository data and executing hooks based on it.
Ingestion points: Reads repository state via Git and scans the directory structure for environment files.
Boundary markers: Lacks explicit markers to separate untrusted repository content from instructions, though it provides explicit constraints on how the agent should handle the data.
Capability inventory: Includes shell command execution, file system modifications (writes_to), and the ability to start/stop server processes.
Sanitization: There is no evidence of sanitization or validation of repository-provided strings (like branch slugs or environment variable names) before they are used in shell executions.

using-git-worktrees