worktree-setup
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to discover and execute shell commands found within the target repository's files. It specifically instructs the agent to 'Discover the documented development command and its prerequisites from scripts, manifests, lockfiles...' and 'Run the same documented development command expected in the primary checkout.' This behavior allows for the execution of arbitrary commands defined in the repository.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection. It is instructed to 'Read repository instructions and canonical development documentation before changing setup behavior.' This allows instructions embedded within the repository's documentation to potentially influence or override the agent's logic during the setup process.
- Ingestion points: Repository instructions, development documentation, scripts, manifests, and environment examples (SKILL.md).
- Boundary markers: None identified; instructions are read directly from the repository files without explicit isolation markers.
- Capability inventory: Shell command execution, service provisioning, dependency installation, and file system writes (SKILL.md).
- Sanitization: No evidence of sanitization or validation of the content read from repository files before it influences command execution.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of dependencies using the repository's native package managers. This involves fetching and potentially executing code from external registries (such as npm or PyPI) based on the repository's configuration files.
Audit Metadata