deepseek

The documentation explicitly warns that the 'isolation' provided is merely detection after the fact, not a sandbox. The child process retains full shell access and can exfiltrate data or perform arbitrary actions, contradicting the implication of a secure, isolated 'grunt work' environment.

The 'Security — what isolation actually covers' section admits: 'it does NOT sandbox the child's process. From inside the worktree the child can still run arbitrary shell commands, write to absolute paths... or read/exfiltrate repo contents over the network.'

Skill name or description references a well-known AI brand, which may suggest impersonation.

anthropic

The skill grants the delegated child process full Bash access and auto-approved edits, relying on post-hoc detection rather than sandboxing. This allows a compromised or malicious child process to exfiltrate data or perform unauthorized actions before the 'isolation_breach' is detected.

The delegated child runs with `Bash` in `ALLOWED_TOOLS` and `--permission-mode acceptEdits`... It does not sandbox the child's process.

The skill explicitly admits that 'worktree isolation' is not a process sandbox and does not prevent the child agent from executing arbitrary shell commands or exfiltrating data. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

The delegated child runs with `Bash` in `ALLOWED_TOOLS`... it does NOT sandbox the child's process. From inside the worktree the child can still run arbitrary shell commands.

NER model detected organization in skill content (confidence: 0.59)

D****