The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell commands to manage parallel development environments. This includes git operations (git worktree add, git worktree list, git worktree remove), application management (docker compose up, make tailwindcss), and background process execution.
[INDIRECT_PROMPT_INJECTION]: The skill uses user-supplied branch names as variables in shell commands (e.g., git worktree add .worktrees/<branch-name> -b <branch-name>). This creates a vulnerability where an adversarial user could provide a branch name containing shell metacharacters (e.g., ;, &&, ||) to execute arbitrary commands on the host system.
Ingestion points: User-provided branch name input in SKILL.md.
Boundary markers: Absent.
Capability inventory: File system access, process management, and network tool execution (via git, sed, docker, kill).
Sanitization: Absent; the skill relies on natural language instructions for the agent to follow naming conventions rather than enforcing programmatic sanitization.
[CREDENTIALS_UNSAFE]: The workflow explicitly directs the agent to copy environment files (cp ../../.env* .) from the project root into worktree subdirectories. As .env files typically contain sensitive credentials such as API keys and database passwords, this practice involves the programmatic handling and duplication of secrets.
[DYNAMIC_EXECUTION]: The skill executes local helper scripts (scripts/allocate-ports.sh and scripts/shutdown-services.sh) at runtime. The shutdown script dynamically discovers and terminates processes using lsof and kill based on port values parsed from .env files, which could lead to unintended process termination if the environment configuration is manipulated.

worktrees