using-git-worktrees
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to automate the creation of Git worktrees and project initialization. Logic inscripts/setup-worktree.shexecutes commands such asgit worktree add,npm install,go mod download,pip install, andcargo buildbased on detected project manifest files. The implementation uses robust shell scripting practices, includingset -euo pipefailand double-quoting variables to prevent common injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of external packages from official registries (such as NPM, PyPI, or Crates.io) when executing dependency managers during the worktree setup process. This behavior is consistent with the skill's stated purpose of preparing a development environment.
Audit Metadata