The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates variables like <branch-name> and <path> directly into shell commands. If the agent does not properly escape these values, a branch name containing shell metacharacters could lead to command injection. Evidence includes the usage of git worktree list --porcelain | grep -A2 "<branch-name>" and git worktree remove <path> in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from GitHub pull requests, including titles and states, which are displayed to the agent and could contain instructions intended to influence its behavior. Evidence Chain: (1) Ingestion points: The output of gh pr list --json number,title,state is read into the agent context in SKILL.md; (2) Boundary markers: None identified, as the data is processed directly in the workflow; (3) Capability inventory: The skill can execute destructive actions such as git worktree remove --force and git branch -d in SKILL.md; (4) Sanitization: No sanitization or escaping of the PR metadata is performed before display.

drop-worktree