The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to parse and execute arbitrary shell commands found within AGENTS.md and CLAUDE.md. It also uses a bundled shell script that performs potentially destructive operations like rm -rf and git branch -D on target directories without requesting user confirmation. While these are part of the cleanup purpose, they represent a significant capability that can be misused by untrusted content.
[INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface where instructions from repository files are used to drive shell command execution.
Ingestion points: Commands are extracted from AGENTS.md and CLAUDE.md files located within the repository being cleaned (identified in SKILL.md).
Boundary markers: None. The skill does not use delimiters or provide warnings to the agent to ignore embedded instructions within the parsed files.
Capability inventory: The skill has access to shell execution, directory deletion (rm -rf), and Git management tools via scripts/remove-worktree.sh.
Sanitization: There is no evidence of sanitization or validation of the commands read from the repository files before they are passed to the shell.
[DYNAMIC_EXECUTION]: The skill dynamically reads lines from markdown files at runtime and executes them as shell commands. This execution of dynamically retrieved content represents a risk of arbitrary code execution controlled by the repository's state, bypassing the static instructions of the skill itself.
[EXTERNAL_DOWNLOADS]: The skill fetches metadata from GitHub using the gh CLI tool to determine the status of pull requests (e.g., gh pr list --head <branch> --state all). This is a legitimate interaction with a well-known service for project management tasks and does not involve downloading untrusted executable code.

clean-worktrees