worktree-create
Warn
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill extracts and runs shell commands defined in repository manifests (e.g.,
package.json,Makefile,pyproject.toml). It specifically executes install commands and health-check scripts, which are inherently untrusted data from the repository's perspective. - [CREDENTIALS_UNSAFE]: The instructions explicitly direct the agent to copy git-ignored files that often contain secrets, such as
.env,*.pemkeys, and service account JSON files, into new worktree directories. - [REMOTE_CODE_EXECUTION]: The skill performs code execution based on external repository configuration. A malicious codebase can define harmful scripts in its package manifest or CI configuration that the skill will then execute during the setup process.
- [DATA_EXFILTRATION]: The skill reads sensitive credentials and then executes arbitrary 'health check' commands. This combination creates a pathway for exfiltrating local secrets if the health check command is configured to send data to a remote server.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted repository data (manifests, workflows, READMEs) and interpolates it into subagent prompts without sanitization or boundary markers. Ingestion points:
package.json,pyproject.toml,Makefile,.github/workflows/*. Capability inventory:git,cp, package managers, health check execution. Sanitization and boundary markers are absent.
Audit Metadata