The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Git and filesystem commands via bundled Bash and PowerShell scripts. It properly quotes all variables and handles arguments as distinct tokens, preventing command injection from user-supplied inputs such as branch names or base refs.
[PROMPT_INJECTION]: The skill processes branch names and reference names which could be sourced from external data like Pull Request descriptions. The analysis identifies this as a potential indirect injection surface, but notes that risks are mitigated by the underlying script implementation.
Ingestion points: branch-name and from-branch parameters in scripts/worktree-manager.sh and scripts/worktree-manager.ps1.
Boundary markers: None explicitly defined.
Capability inventory: Git worktree operations, directory creation, file copying, and configuration trust management.
Sanitization: Bash shell quoting and PowerShell's native argument array handling effectively prevent the execution of injected subcommands.
[REMOTE_CODE_EXECUTION]: The utility automates the trust mechanism for environment tools like mise and direnv. It includes a security feature that verifies the cryptographic hash of local configuration files against a trusted base branch (e.g., main or develop) before granting trust, ensuring that malicious configurations from feature branches are not automatically executed.

worktree