work-in-tree
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard Git commands to manage isolation.
- Evidence includes usage of
git worktree list,git worktree add, andgit -Cto manage separate working directories. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and follow instructions found within the target repository, which represents a potential injection surface if the repository is malicious.
- Ingestion points: Reads repository instructions, Git status, and porcelain output in
SKILL.md(Step 1 and Step 2). - Boundary markers: None explicitly defined for untrusted repository content.
- Capability inventory: File system writes (
git worktree add), potential command execution during setup/build/test phases, and Git commits. - Sanitization: Not present; the agent is instructed to follow repository-prescribed workflows directly.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to execute "repository-prescribed setup" scripts and validation workflows within the newly created worktree.
- Evidence: Step 2 mentions running "repository-prescribed setup" and Step 3 mentions performing tasks under "normal development and validation workflow".
Audit Metadata