kata-configure-settings
Warn
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
setup-worktrees.shscript executes destructive commands, includingrm -rfon files in the project root and deletion of the.gitdirectory, to migrate the repository to a worktree-based layout. While intended for its purpose, these operations carry high risk of data loss if the script fails or is run in an unexpected environment. - [COMMAND_EXECUTION]: The skill facilitates the configuration of 'workflow variant' settings (
post_task_command,extra_verification_commands,pre_release_commands) which are designed to store and later execute arbitrary shell commands. This creates a persistent command execution surface where malicious instructions could be embedded in the project's configuration files. - [COMMAND_EXECUTION]: The
setup-worktrees.shscript modifies the core repository structure by converting it into a bare repository and manipulating git worktrees, which involves significant direct interaction with the repository's internal metadata.
Audit Metadata