The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): The skill performs automatic package installation using npm install or bun install during the worktree creation process. This involves downloading and executing third-party code from external registries without explicit user validation of the dependencies being fetched.
COMMAND_EXECUTION (MEDIUM): The skill uses the Bash tool to perform high-privilege system operations, including kill -9 for process termination and directory removal. These actions are performed based on branch names which are user-controlled and not explicitly sanitized.
REMOTE_CODE_EXECUTION (MEDIUM): The dependency installation phase executes code from potentially untrusted sources via package scripts (preinstall/postinstall) that run during the installation process.
PROMPT_INJECTION (LOW): The skill is vulnerable to indirect prompt injection.
Ingestion points: Branch names provided as arguments to /create_worktree and /remove_worktree in OPERATIONS.md and SKILL.md.
Boundary markers: Absent. The branch name is treated as a direct string argument for shell commands.
Capability inventory: Extensive shell access via the Bash tool for git operations, directory management, and package installation.
Sanitization: Absent. There is no instruction to validate or escape branch names before they are interpolated into commands like git worktree add trees/<branch-name>. An attacker could provide a branch name containing shell metacharacters to execute unauthorized commands.

worktree-manager-skill