The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it ingests untrusted metadata from the local filesystem—specifically Git branch names and directory paths—and uses them as arguments in shell commands. While no malicious behavior is present, a repository with specially crafted branch names (e.g., containing shell metacharacters) could potentially attempt to influence command execution.\n
Ingestion points: The skill reads branch names via git branch -vv and worktree paths via git worktree list (SKILL.md).\n
Boundary markers: There are no explicit delimiters or instructions to treat these specific inputs as potentially untrusted data.\n
Capability inventory: The skill uses these inputs as arguments for gh pr list, git branch -D, and git worktree remove (SKILL.md).\n
Sanitization: The instructions do not explicitly mandate sanitization or escaping of the branch names or paths before they are passed to the shell.

cleanup