git-worktree-remove

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a Python script to execute Git operations via subprocess.run. The implementation uses list-based arguments and does not enable shell=True, which is a secure method for executing system commands that prevents shell injection vulnerabilities.
  • [SAFE]: The script implements robust safety logic, specifically blocking actions on protected branches (e.g., main, master, develop) and requiring a force flag to remove worktrees with uncommitted changes.
  • [SAFE]: No suspicious network activity, data exfiltration, or credential harvesting patterns were detected. The skill's operations are confined to the local repository and its configured remotes.
  • [SAFE]: The external dependency used (rich) is a well-known library for terminal formatting, and script execution is managed through uv, following standard development practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 08:50 AM
Security Audit — agent-trust-hub — git-worktree-remove