The Agent Skills Directory

[PROMPT_INJECTION]: The skill utilizes external data as a source of executable instructions, creating an indirect prompt injection surface.
Ingestion points: SKILL.md identifies worktrees/worktree-modes.yaml and AGENTS.md as sources of truth for startup, selection, and scaffolding instructions.
Boundary markers: The instructions lack delimiters or explicit warnings to treat the content of the repository files as untrusted data.
Capability inventory: The agent is authorized to perform shell command execution for setup, startup, and readiness checks, and can perform network requests via curl for service verification.
Sanitization: Although the skill implements output sanitization (refusing to print secrets), it does not provide validation or sanitization for the commands retrieved from the configuration files before they are executed.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands specified within the workspace configuration.
Evidence: SKILL.md instructs the agent to "Follow the selected mode entry... exactly... Run only its scaffolding/setup commands" and "Run every startup command for the selected mode."
Evidence: The skill uses curl -fsS for readiness verification, which can be used to interact with arbitrary endpoints specified in the configuration.

create-worktree