The Agent Skills Directory

[COMMAND_EXECUTION]: The launch_terminal method in scripts/run_worktree-manager.py is vulnerable to shell command injection. It constructs command strings for terminal execution using unsanitized worktree names.
Evidence: In scripts/run_worktree-manager.py, the Windows implementation uses subprocess.Popen(cmd, shell=True) with string interpolation (line 248). The Unix-like implementation uses bash -c with interpolated strings (lines 257-260). An attacker-controlled worktree name containing shell metacharacters (e.g., ;, &, |) could execute arbitrary commands.
[DYNAMIC_EXECUTION]: The skill uses subprocess.Popen to dynamically launch shell environments and subprocess.run for Git operations based on user-provided task descriptions and arguments.
Evidence: scripts/run_worktree-manager.py uses subprocess.run for multiple Git operations including worktree add and merge.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture creates a surface for indirect prompt injection where malicious instructions in the codebase could influence agent behavior.
Ingestion points: The skill uses codex_read_file, codex_codebase_search, and git log to analyze repository content in SKILL.md and agents/openai.yaml.
Boundary markers: Absent. There are no instructions to the agent to treat repository content as untrusted or to ignore embedded instructions within data files.
Capability inventory: The agent has high-privilege capabilities including bash access, file write access, and Git management tools.
Sanitization: No sanitization or validation logic is present in the Python orchestration script to filter content read from the repository before it is processed or reported.

worktree-manager