The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill takes an 'idea' from the user as its primary argument and writes it into a handoff file which is then used as the context for a new 'thinking' agent session. This creates a surface where a user could provide an idea containing malicious instructions designed to subvert the behavior or safety guidelines of the newly spawned agent session.
Ingestion points: The argument-hint ('The idea') in SKILL.md is the entry point for untrusted data.
Boundary markers: The instructions do not specify the use of delimiters, XML tags, or 'ignore embedded instructions' warnings when writing the user-provided idea to the handoff markdown file.
Capability inventory: The skill possesses the ability to execute system commands via <worktree-tool>, interact with remote repositories (GitHub), and spawn new processes via <agent>.
Sanitization: There is no explicit sanitization or validation of the 'idea' string before it is interpolated into the handoff file or the starting prompt for the next agent session.
[COMMAND_EXECUTION]: The skill's primary functionality involves executing shell-level commands and tools such as Git, worktree managers, and agent wrappers. While this is expected behavior for repository management, it involves high-privilege operations such as repository initialization, configuration, and remote pushing.

init-effort