The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run a shell script (scripts/worktree.sh) with subcommands such as setup, land, and teardown. These commands process arguments like branch names and directory paths.
[DATA_EXFILTRATION]: The instructions mandate symlinking environment configuration files (e.g., .env) between the main repository and worktree directories. This constitutes systematic access to sensitive credential files for the purpose of sharing state across parallel agent environments.
[COMMAND_EXECUTION]: The teardown procedure targets directories outside the immediate repository root (using paths like ../<repo>-<slug>), which requires the agent to perform file system operations on parent directories.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it accepts externally provided data, such as branch names and repository slugs, which are then passed as arguments to shell scripts. If these inputs contain shell metacharacters and the scripts do not implement strict sanitization, it could lead to arbitrary command execution.

agent-worktrees