The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation for the worktree configuration (worktree.yaml) explicitly references and supports the copying of sensitive files and credential stores to isolated worktree environments. Examples provided in the documentation include .env, .env.local, .npmrc, credentials.json, firebase-credentials.json, and google-cloud-key.json. While intended to maintain local development environment parity across git worktrees, this encourages the management of sensitive secrets within the skill's operational scope.
[PRIVILEGE_ESCALATION]: The system's multi-agent pipeline scripts (specifically multi_agent/start.py) are documented to invoke the Claude CLI using the --dangerously-skip-permissions flag. This flag grants the dispatch agent high autonomy by bypassing the standard platform requirement for manual user confirmation before the agent can execute tools (such as bash commands or file writes), significantly increasing the potential impact if the agent is compromised.
[COMMAND_EXECUTION]: The Trellis system is architecturally designed to execute arbitrary shell commands defined in local configuration files. Specifically, config.yaml supports lifecycle hooks (after_create, after_start, etc.) and worktree.yaml supports post_create and verify commands. These commands are executed by the automation scripts during various phases of the task lifecycle, presenting a vector for command injection if the configuration files are sourced from or modified by untrusted inputs.
[INDIRECT_PROMPT_INJECTION]: The skill architecture creates a significant surface for indirect prompt injection through its automated context injection mechanism. The inject-subagent-context.py hook script dynamically reads content from external sources—including prd.md requirements files, JSONL context files, and specification documents—and interpolates them directly into sub-agent prompts.
Ingestion points: Files located in the .trellis/tasks/ and .trellis/spec/ directories.
Boundary markers: The system uses visual separators (e.g., === file path ===) to delimit injected content, which provides some structure but may not prevent instruction overriding by malicious content embedded within those files.
Capability inventory: Sub-agents (Implement, Check, Debug) are granted broad tool access including Bash, Write, and Edit operations.
Sanitization: There is no documented evidence of content sanitization or instruction filtering before the external data is injected into the agent's context.

trellis-meta