The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically reads and executes shell commands defined in a repository's metadata files (AGENTS.md or CLAUDE.md) under a ## Worktree cleanup section. This functionality allows the project being cleaned to dictate arbitrary commands that the agent will run locally during the cleanup process.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests instructions from untrusted repository files and executes them with high-privilege shell capabilities.
Ingestion points: Files AGENTS.md and CLAUDE.md in the repository being cleaned (specified in SKILL.md).
Boundary markers: The agent is instructed to look for a specific header (## Worktree cleanup) and extract commands from a fenced code block.
Capability inventory: The skill uses shell execution to run the discovered cleanup commands and performs filesystem deletions via rm -rf and git worktree remove.
Sanitization: There is no validation or sanitization of the commands extracted from the project files; they are executed directly in sequence.
[COMMAND_EXECUTION]: The skill bundles a bash script scripts/remove-worktree.sh which executes high-risk operations including rm -rf -- "$target" and git branch -D. While the script includes internal logic to verify that the target is a worktree, these commands operate on computed paths which could be manipulated.
[PROMPT_INJECTION]: The skill instructions contain a directive to "Do not ask for confirmation along the way." This instruction overrides standard safety practices by encouraging the agent to perform destructive filesystem and command execution operations autonomously, significantly increasing the potential impact of any malicious project-defined cleanup commands.

clean-branches