worktree
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to run command-line utilities. It executes Git commands likegit worktree,git branch, andgit rev-parse, as well as GitHub CLI commands likegh pr list. Additionally, it calls a local vendor scriptscripts/worktree-cleanup.shfor batch processing operations. The skill uses user-supplied arguments to construct file paths for worktree creation (e.g.,~/Documents/<repo>-<name>), which are then passed to shell commands.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes output from external tools, which introduces a surface for indirect prompt injection.\n - Ingestion points: Data is ingested from the outputs of
git worktree list --porcelain,gh pr list, andgit branch --merged.\n - Boundary markers: No specific delimiters or safety instructions are defined to separate tool output from instructions.\n
- Capability inventory: The skill has the ability to delete directories and branches (
git worktree remove,git branch -d) and execute local scripts.\n - Sanitization: There is no evidence of explicit sanitization or validation of the data retrieved from Git or GitHub before it is used in subsequent command executions.
Audit Metadata