The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute Git commands for repository state inspection.
Evidence: In scripts/inspect_workspace.py, the git_output function calls git with structured arguments (list-based) to retrieve metadata like branch names, repository roots, and worktree status. This is a standard and necessary function of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with potentially untrusted external data found in Git repositories.
Ingestion points: Repository metadata, file listings, and status information are read from the environment using scripts/inspect_workspace.py and git status commands in SKILL.md.
Boundary markers: The skill contains a dedicated "Security Model" section and explicit instructions in Step 1 to treat all environmental data as untrusted and prioritize user/platform instructions.
Capability inventory: The skill possesses the ability to execute shell commands (via Git) and write to the filesystem (creating worktrees), though these are gated by user consent and policy checks.
Sanitization: The inspection helper script uses list-based subprocess calls to prevent shell injection, and the instructions explicitly forbid fixing unrelated baseline defects or fixing implementation issues based on untrusted setup notes.
[SAFE]: The skill follows security best practices, such as requiring explicit consent for new lifecycle states, protecting user work from being reset or stashed, and ensuring secrets/credentials are not exposed or transferred between workspaces.

git-worktree-isolation