The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive application data by reading from ~/Library/Application Support/Claude/claude-code-sessions on macOS. This directory contains internal JSON files belonging to the Claude desktop application, which include session history, working directories, and task titles. While this is documented as the method for retrieving workspace labels, it involves reading from a private application data store.
[COMMAND_EXECUTION]: The script uses execFileSync to execute git commands for worktree management and code to launch the VS Code application. These commands are directed by arguments provided to the skill, such as the --repo path.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a surface for indirect prompt injection.
Ingestion points: The script reads Git commit subjects via git log and session titles from the desktop application's internal JSON files.
Boundary markers: No delimiters or safety instructions are used to wrap this external content when it is processed or printed.
Capability inventory: The skill has the ability to write files to the local disk and execute system commands (git, code).
Sanitization: While commit subjects are truncated to 60 characters for display, there is no filtering or escaping of the content to prevent potential instruction injection if the agent later parses the script's output.

worktree-workspace