worktree-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly runs GitHub CLI commands to read PR state and metadata from GitHub (see scripts/status.sh and reference/cleanup-operations.md which call gh pr list / gh pr view) and uses that untrusted, user-generated third‑party content to decide and perform actions like auto-cleanup and branch deletion, which can materially influence tool use and next steps.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs agents to bypass permission checks (using --dangerously-skip-permissions) and performs global filesystem and registry modifications (creating/removing worktrees, copying ~/.claude, updating ~/.claude/worktree-registry.json, running hooks that can rm -rf paths and install dependencies), enabling autonomous, potentially destructive changes to the host.