using-git-worktrees

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to automate the creation of Git worktrees and project initialization. Logic in scripts/setup-worktree.sh executes commands such as git worktree add, npm install, go mod download, pip install, and cargo build based on detected project manifest files. The implementation uses robust shell scripting practices, including set -euo pipefail and double-quoting variables to prevent common injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill triggers the download of external packages from official registries (such as NPM, PyPI, or Crates.io) when executing dependency managers during the worktree setup process. This behavior is consistent with the skill's stated purpose of preparing a development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 08:41 PM
Security Audit — agent-trust-hub — using-git-worktrees