The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local shell script located at scripts/runbooks/select-runbooks.sh to determine workflow logic and retrieve additional instructions.
[CREDENTIALS_UNSAFE]: The instructions direct the agent to copy .env files and local configuration overrides to new worktree paths. While this is a common developer workflow for environment setup, .env files are sensitive and typically contain credentials, tokens, or private configuration.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting the output of an external script and applying it as additional instructions ('runbooks') for the agent's behavior.
Ingestion points: Output from the execution of bash scripts/runbooks/select-runbooks.sh --skill he-worktree (Phase 0, step 7).
Boundary markers: The skill lacks technical boundary markers or delimiters for the injected content, though it includes a policy-based instruction that runbooks 'must not waive or override gates codified here'.
Capability inventory: The skill has the ability to execute arbitrary git commands, read/write files (including sensitive paths like .env), and execute local shell scripts.
Sanitization: There is no evidence of validation, sanitization, or filtering of the content returned by the runbook selection script before it is integrated into the prompt context.

he-worktree