superpowers-using-git-worktrees
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage Git worktrees and initialize project environments.
- Uses
git worktree,git rev-parse, andgit check-ignoreto manage repository state. - Automatically invokes build and test tools including
npm,cargo,pip,poetry, andgobased on the presence of configuration files likepackage.jsonorCargo.toml. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of external dependencies through standard package managers.
- Commands such as
npm install,pip install, andgo mod downloadconnect to well-known official registries to fetch project requirements. - [PROMPT_INJECTION]: The skill ingests data from local configuration files which could potentially contain malicious content.
- It searches
CLAUDE.mdfor worktree directory preferences. While this is a data ingestion point, the skill uses the extracted data only for directory path selection, and the logic includes manual confirmation if no preference is found.
Audit Metadata