kata-configure-settings

Warn

Audited by Gen Agent Trust Hub on Apr 10, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The setup-worktrees.sh script executes destructive commands, including rm -rf on files in the project root and deletion of the .git directory, to migrate the repository to a worktree-based layout. While intended for its purpose, these operations carry high risk of data loss if the script fails or is run in an unexpected environment.
  • [COMMAND_EXECUTION]: The skill facilitates the configuration of 'workflow variant' settings (post_task_command, extra_verification_commands, pre_release_commands) which are designed to store and later execute arbitrary shell commands. This creates a persistent command execution surface where malicious instructions could be embedded in the project's configuration files.
  • [COMMAND_EXECUTION]: The setup-worktrees.sh script modifies the core repository structure by converting it into a bare repository and manipulating git worktrees, which involves significant direct interaction with the repository's internal metadata.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 10, 2026, 12:00 PM