The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructs the agent to automatically execute package managers and build tools such as npm install, pip install, poetry install, go mod download, and cargo build upon detecting project-specific manifest files. This behavior executes scripts and logic defined within the repository, which poses a risk if the repository contains malicious configuration.
[DYNAMIC_EXECUTION]: Includes a shell helper function run_with_timeout that falls back to executing a Perl one-liner (perl -e 'use POSIX qw(SIGALRM); alarm shift; exec @ARGV or die "$!"') to implement timeout functionality when standard system utilities are missing.
[COMMAND_EXECUTION]: The skill performs multiple automated shell operations including creating directories, moving files, modifying .gitignore, and creating Git commits without explicit per-step user confirmation.
[INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface for indirect instructions.
Ingestion points: Reads project configuration from CLAUDE.md, package.json, Cargo.toml, requirements.txt, pyproject.toml, and go.mod.
Boundary markers: None identified.
Capability inventory: Shell command execution, Git repository modification, package manager execution (npm, pip, cargo, go, poetry), and Perl script execution.
Sanitization: None; the skill proceeds with execution based on the presence and content of detected files.

using-git-worktrees