git-worktrees

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary function is executed through a series of shell commands including git, bash, and various language-specific package managers (npm, pip, cargo, etc.). These commands are used to create, navigate, and prepare Git worktrees.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations via git fetch to retrieve remote branches and pull requests. Additionally, it automates the installation of dependencies using tools like npm, pnpm, yarn, pip, uv, poetry, flutter, dart, cargo, and go when entering a new worktree.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by processing untrusted data from the repository.
  • Ingestion points: The script scripts/copy_worktreeinclude.py reads the .worktreeinclude file, and the dependency installation logic in claude-code.md reads project manifest files (e.g., package.json, requirements.txt).
  • Boundary markers: No explicit boundary markers or warnings are used when processing these files to prevent the agent from following embedded instructions.
  • Capability inventory: The agent can write files (via copy_path in the Python script), execute shell commands, and perform network requests (via package managers).
  • Sanitization: The Python script includes a check to avoid copying .git internal directories, but otherwise relies on git ls-files to provide relative paths from the repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 10:02 AM
Security Audit — agent-trust-hub — git-worktrees