The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where instructions or configurations within an untrusted repository could influence the agent's behavior.
Ingestion points: The skill reads CLAUDE.md to determine directory preferences and parses project manifest files such as package.json, requirements.txt, Cargo.toml, go.mod, and pyproject.toml to decide which setup commands to run (evidence in SKILL.md).
Boundary markers: Absent; there are no instructions to wrap external content in delimiters or to treat data from these files as untrusted.
Capability inventory: The skill utilizes shell execution for git, npm, cargo, pip, poetry, go, and project-specific test runners like pytest or npm test (documented in SKILL.md).
Sanitization: No explicit sanitization or validation is mentioned for variables like $BRANCH_NAME or directory paths before they are used in shell commands.
[COMMAND_EXECUTION]: The skill directs the agent to perform extensive shell operations, including the automated installation of dependencies and execution of test suites. While these are common developer tasks, they are executed based on the presence of files within the local environment.

using-git-worktrees