The Agent Skills Directory

[DATA_EXPOSURE]: The script incorporates a proactive protection mechanism via the deny_path function, which blacklists sensitive patterns including .ssh/, .aws/, .env files, and various private key formats. This prevents these files from being copied from the main repository into newly created implementation or prototype worktrees, thereby minimizing the risk of credential leakage.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the repository (e.g., git status) and structured session files (e.g., session.json). The analysis identified the following security properties:
Ingestion points: Data enters the skill via session.json, verdict.json, and the output of git status --porcelain.
Boundary markers: The script uses strict JSON schema validation and checks for specific schema_version values before processing metadata.
Capability inventory: Capabilities are limited to local filesystem operations, git commands, and local loopback socket binding.
Sanitization: The implementation uses pathlib.resolve().relative_to() to prevent path traversal when verifying artifacts and employs NUL-safe path handling (-z and -print0) for all file list processing.
[DYNAMIC_EXECUTION]: The script utilizes embedded Python code blocks to perform specialized tasks such as port reservation and JSON validation. These blocks are executed as heredocs, ensuring that the execution logic is fixed and preventing the injection of arbitrary code into the Python interpreter.
[COMMAND_EXECUTION]: All user-supplied inputs, including worktree slugs and session identifiers, are validated against restrictive regular expressions (^[a-z0-9][a-z0-9-]*$) prior to being used in shell commands. This effectively prevents command injection through manipulated arguments.

spine-worktree