worktree-merge
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically identifies and executes arbitrary shell commands extracted from repository files.
- Evidence: In
SKILL.md, the instructions state: "Find the commands that prove this project works, preferring what CI already runs: read.github/workflows/*, aMakefile, or the manifest's test/lint scripts, and reuse those exact commands." - Risk: An attacker could place malicious commands in a project's
Makefileor GitHub Action workflow. Since the skill is instructed to "reuse those exact commands" without validation, it would execute them with the user's local shell privileges. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via untrusted repository data.
- Ingestion points: The agent reads
.github/workflows/*,Makefile, and project manifests (package.json,pyproject.toml). - Boundary markers: No delimiters or instructions are provided to the agent to treat the content of these files as data rather than instructions.
- Capability inventory: The skill has the capability to execute shell commands, perform git merges, delete branches, and remove git worktrees.
- Sanitization: There is no evidence of sanitization or validation of the commands extracted from the repository files before execution.
Audit Metadata