The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various Git and shell commands based on user-provided arguments like branch names and author names, which could be exploited if arguments are not properly sanitized.
Evidence: git -C <worktree_path> rebase <target_branch> in catalog/rebase-worktrees.md uses the target branch argument.
Evidence: git log --author="name1\|name2" in catalog/report-daily-worklog.md uses the authors argument.
Evidence: Complex shell piping is used in catalog/branch-clear-gone.md to automate worktree and branch deletion.
[CREDENTIALS_UNSAFE]: The skill performs operations that access or risk exposing sensitive information like environment variables and uncommitted secrets.
Evidence: catalog/rebase-worktrees.md reads .env files to compare and synchronize keys across different Git worktrees.
Evidence: catalog/commit-detail.md instructs the agent to run git add -A and explicitly states to "include all working-tree changes... never selectively exclude or revert," which bypasses selective staging and may lead to the accidental commit of secrets, tokens, or private keys not handled by .gitignore.
[EXTERNAL_DOWNLOADS]: The skill automatically triggers package manager commands that fetch dependencies from remote registries during worktree rebasing.
Evidence: catalog/rebase-worktrees.md executes bun install, pnpm install, yarn install, or npm install after a successful rebase.
[INDIRECT_PROMPT_INJECTION]: The skill reads external code files (e.g., for conflict resolution or simplification), creating a surface for indirect prompt injection attacks if those files contain malicious instructions.
Ingestion points: catalog/resolve-conflict.md (reads unmerged paths) and catalog/code-simplify.md (reads target files).
Boundary markers: The instructions lack specific delimiters or escaping requirements for the ingested file content.
Capability inventory: The skill has the ability to execute shell commands (git), write files (catalog/report-weekly.md), and delegate tasks to subagents (task tool).
Sanitization: No explicit content validation or sanitization is described for the ingested data.

qwe-lgnh