The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the pr-fanout functionality. It retrieves branch names from external Pull Requests using gh pr list and uses them directly in shell commands.
Ingestion points: PR metadata (specifically headRefName) fetched in SKILL.md.
Boundary markers: None. The skill lacks markers or instructions to treat PR data as untrusted.
Capability inventory: Shell execution of git worktree add, git fetch, and filesystem operations via git.
Sanitization: None. There is no validation or escaping of the branch names before interpolation into the shell script.
[COMMAND_EXECUTION]: The skill interpolates user-supplied task names and externally-supplied PR branch names into shell commands. While the provided snippets use double quotes, malicious input could exploit the shell environment or cause path traversal.
Evidence: The variable BRANCH derived from PR data is used in git fetch origin "$BRANCH:refs/remotes/origin/$BRANCH" and git worktree add "$WORKTREE_PATH" "origin/$BRANCH".
Evidence: The WORKTREE_PATH is constructed as "../${REPO_NAME}-pr-${PR}", where untrusted branch names or identifiers could potentially lead to path traversal if the agent's environment does not enforce strict path limitations.

worktree-management