worktree-data-sync

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts use subprocess.run to execute git and cp commands. These calls use argument lists rather than shell strings, and paths are validated before use, minimizing the risk of command injection.
  • [DATA_EXFILTRATION]: No network operations were found. The skill only performs local file read and write operations within the scope of the git repository's worktrees.
  • [PROMPT_INJECTION]: The SKILL.md contains purely technical instructions for using the CLI tool and does not attempt to override agent behavior or bypass safety filters.
  • [EXTERNAL_DOWNLOADS]: No external packages or scripts are downloaded. The project relies on Python standard libraries and pytest for testing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 02:13 PM
Security Audit — agent-trust-hub — worktree-data-sync