The Agent Skills Directory

[COMMAND_EXECUTION] (MEDIUM): Potential shell command injection in terminal automation scripts.- Evidence (references/functions.sh): The wt function takes a user-provided name and passes it to the _wt_iterm2_tab function.- Evidence (references/functions.sh): Inside _wt_iterm2_tab, an AppleScript is executed that uses write text "cd '" & worktreePath & "' && clear". If the worktree name (and thus the path) contains a single quote, it can break the shell string and execute arbitrary commands in the new iTerm2 tab context.- Evidence (references/iterm2-config.md): Similar unsafe interpolation patterns exist in the AppleScript code snippets provided for iTerm2 profiles and scripts, such as write text "cd '" & worktreePath & "' && clear && echo '[WORKTREE] " & worktreeName & " ready'".

git-worktree