The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill requires the agent to ingest and act upon data from untrusted files within a repository (e.g., AGENTS.md and project instructions), which can lead to the execution of malicious instructions embedded in those files.
Ingestion points: AGENTS.md and project instruction files read during the repository setup phase (SKILL.md, Workflow Step 6).
Boundary markers: Absent; there are no instructions to wrap these external inputs in delimiters or to treat the content as untrusted.
Capability inventory: The skill performs git command execution and file system management, and it explicitly permits running setup scripts and baseline checks based on repository content (SKILL.md, Workflow Step 6).
Sanitization: Absent; the skill does not specify any validation, escaping, or filtering for the content retrieved from repository files.
[COMMAND_EXECUTION]: Execution of system commands via the Git binary. The skill relies on local git operations for worktree lifecycle management.
Evidence: The skill instructions utilize git --version, git worktree list, git worktree add, git worktree remove, and git worktree move (SKILL.md, sections 'Discover the local interface' and 'Workflow').
Mitigation: The skill includes defensive instructions, such as prohibiting the use of rm -rf, requiring explicit user confirmation before destructive actions, and forbidding the automatic copying of sensitive data like .env files or SSH keys.

git-worktrees