The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and prioritize instructions from CLAUDE.md and AGENTS.md files located within user-specified repositories. Since these files are external to the skill and potentially provided by a third party, they constitute untrusted input that can override the agent's current instructions.
Ingestion points: File content from CLAUDE.md and AGENTS.md in the target repository path.
Boundary markers: Absent; the instructions explicitly state that the new repository's root files should "supersede" the launch repository's files.
Capability inventory: Full shell access via the Bash tool and session re-rooting capabilities via EnterWorktree.
Sanitization: No sanitization or safety markers are used when loading these instructions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute wt and git commands (e.g., wt -C <repo> switch --create <branch>). The parameters for these commands are derived from raw user input provided in $ARGUMENTS. If the agent fails to properly escape these strings, it could lead to command injection, although this is mitigated by the platform's internal tool safety layers.

wt-switch-create