Add Backlog Items

The skill explicitly reads and executes a command specified in the '.sprint-config' file ('worktree.command'). If an attacker can control this configuration file, arbitrary commands can be executed on the host system.

Use command from .sprint-config (worktree.command)

The skill prompts the user for a sprint 'path or name'. If this input is not properly sanitized, it could lead to path traversal, allowing the agent to read or write files outside the intended sprint directory.

If not found, ask: 'Which sprint? (path or name)'

User-provided Feature Names are used to construct branch names and worktree paths. If these inputs are not sanitized before being used in shell commands (e.g., 'git worktree add'), it could lead to command injection.

Suggest branch name: feature/F{n}-{kebab-name}

The skill explicitly executes 'git worktree list', demonstrating direct command execution capability. This confirms the agent's ability to interact with the underlying shell environment.

Show existing worktrees: `git worktree list`