The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by concatenating strings from external configuration files without sufficient sanitization. In lib/worker-spawn.sh, the build_inner_cmd function iterates over the extra_exports argument and appends it directly to a command string. In launch.sh, this argument includes the branch name from fleet.json. If this value contains shell metacharacters (e.g., ;, &&), it could lead to arbitrary command execution when the resulting string is executed via bash -c inside a tmux session.
[REMOTE_CODE_EXECUTION]: The skill's primary function is to spawn sub-agents using claude -p or codex exec. For Claude workers, it uses the --dangerously-skip-permissions flag, which bypasses standard human-in-the-loop permission prompts for tool execution. This allows the sub-agents to perform operations with reduced oversight.
[COMMAND_EXECUTION]: The cleanup.sh script employs broad process termination logic. It uses pgrep -f with the FLEET_ROOT path to identify and kill processes. If the FLEET_ROOT points to a common or root-level directory, this could result in the unintended termination of unrelated system processes matching the string.
[COMMAND_EXECUTION]: The cleanup.sh script executes rm -rf on paths derived from the worktree directory structure. While intended for cleaning up the fleet, the lack of rigorous path validation before execution poses a risk of unintended file deletion if the fleet configuration is misconfigured or maliciously crafted.

worktree-fleet