The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill automatically executes package managers when setting up a new worktree.
Found in WORKFLOW.md and scripts/setup-worktree.sh.
The automation logic detects files like package.json, requirements.txt, pyproject.toml, go.mod, and Cargo.toml to run commands such as npm install, pip install, uv sync, go mod download, or cargo build.
This behavior presents a risk because these manifest files can contain malicious installation scripts or point to untrusted dependencies, which are executed immediately upon worktree creation from a potentially unverified branch.
[COMMAND_EXECUTION]: The skill provides a mechanism to dispatch arbitrary shell commands to tmux windows.
Evidence in SKILL.md (Step 4) and scripts/setup-worktree.sh.
It specifically demonstrates the use of the --dangerously-skip-permissions flag for the claude command. This flag bypasses security confirmation prompts, which could be exploited to run unauthorized or harmful commands if the task description is influenced by a malicious source.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that ingests data from local project files which could be controlled by an attacker.
Ingestion points: It reads {project-root}/_bmad-output/implementation-artifacts/sprint-status.yaml and {project-root}/_bmad-output/planning-artifacts/epics.md to perform dependency analysis and task planning as described in references/bmad-orchestration.md.
Boundary markers: There are no instructions or delimiters provided to prevent the agent from following instructions hidden within these data files.
Capability inventory: The skill possesses capabilities for command execution via tmux, package installation, and file system modifications.
Sanitization: No validation or sanitization is performed on the content of the sprint or epic files before the agent processes them for planning.

using-git-worktrees