git-worktrees
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function is executed through a series of shell commands including
git,bash, and various language-specific package managers (npm,pip,cargo, etc.). These commands are used to create, navigate, and prepare Git worktrees. - [EXTERNAL_DOWNLOADS]: The skill performs network operations via
git fetchto retrieve remote branches and pull requests. Additionally, it automates the installation of dependencies using tools likenpm,pnpm,yarn,pip,uv,poetry,flutter,dart,cargo, andgowhen entering a new worktree. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by processing untrusted data from the repository.
- Ingestion points: The script
scripts/copy_worktreeinclude.pyreads the.worktreeincludefile, and the dependency installation logic inclaude-code.mdreads project manifest files (e.g.,package.json,requirements.txt). - Boundary markers: No explicit boundary markers or warnings are used when processing these files to prevent the agent from following embedded instructions.
- Capability inventory: The agent can write files (via
copy_pathin the Python script), execute shell commands, and perform network requests (via package managers). - Sanitization: The Python script includes a check to avoid copying
.gitinternal directories, but otherwise relies ongit ls-filesto provide relative paths from the repository.
Audit Metadata