The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local file system that can be influenced by external sources (e.g., a repository owner). Specifically, it reads branch names, file paths, and ignored entries via the worktree-audit.sh script.
Ingestion points: scripts/worktree-audit.sh gathers output from git worktree list, git status --ignored, and git log.
Boundary markers: The script outputs data in a tab-separated format which provides some structural separation, but the instructions lack explicit delimiters to protect the agent from interpreting malicious strings embedded in these local identifiers.
Capability inventory: The skill can execute git worktree remove and git worktree prune on local paths.
Sanitization: The skill uses a safety-first approach by requiring explicit user confirmation for each candidate path and by specifically classifying sensitive file patterns (like .env, .pem, *secret*, *token*) into a 'hold' bucket to prevent deletion.
[COMMAND_EXECUTION]: The skill executes a bundled bash script (scripts/worktree-audit.sh) and standard git commands to perform its auditing and cleanup functions. The script is designed to be read-only during the audit phase.
[SAFE]: The skill demonstrates good security practices by using lsof to check for active processes before attempting deletion and by strictly forbidding the use of recursive deletion (rm -rf) as a fallback mechanism.

worktree-cleanup