The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell command interpolation using variables derived from repository metadata (e.g., branch names) and user input. Specifically, variables such as $NAME and $BRANCH are used in git worktree add and other Bash logic. Without strict escaping of shell-sensitive characters, this presents a surface for command injection.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of repository state. Maliciously crafted branch names could potentially manipulate the logic in Phase 2 (Base Branch Resolution) or trigger unintended behavior during Phase 5 (Worktree Creation).
Ingestion points: Branch names from git symbolic-ref, git worktree list, and user-provided inputs (SKILL.md Phase 1 & 2).
Boundary markers: No explicit delimiters are specified for variable interpolation in instructions.
Capability inventory: Execution of git commands, file system writes to .gitignore, and repository commits (SKILL.md Phase 4 & 5).
Sanitization: The instructions recommend sanitizing directory names but lack specific guidance on escaping branch names for shell safety.
[EXTERNAL_DOWNLOADS]: The skill includes an optional --fetch flag that triggers a git fetch origin command. While this is a standard repository maintenance task, it involves a network request to the configured remote server to retrieve repository metadata and objects.

worktree