close-worktree
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local environment, specifically output from Git commands such as branch names, stash messages, and file lists. While this creates a surface for indirect prompt injection, the risk is inherent to the tool's primary purpose and is mitigated by the following:
- Ingestion points: Git command outputs (
git status,git branch,git stash list) are read into the agent's context in Step 1, 3, and 4. - Boundary markers: The skill explicitly mandates human review checkpoints in Step 2 (clean tree review), Step 3 (stash review), and Step 4 (untracked file inventory) before proceeding with destructive actions.
- Capability inventory: The agent uses filesystem-impacting commands including
git rebase,git merge,git worktree remove, andgit branch -d. - Sanitization: The instructions do not define programmatic sanitization but rely on user confirmation for every critical step to prevent accidental execution of embedded instructions.
Audit Metadata