qrspi-create-worktree
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell scripts (
~/scripts/create_worktree.sh) and a CLI tool (humanlayer launch). These executions are part of the intended workflow and are gated by a manual confirmation step where the agent must present all parameters to the user before proceeding. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted data from external plan files and incorporates that data into shell commands and prompts for a secondary agent session.
- Ingestion points: Plan files read from
thoughts/shared/plans/or a user-provided path. - Boundary markers: Absent; the skill does not include specific delimiters or instructions for the agent to ignore malicious content within the plan files.
- Capability inventory: File system access, shell script execution (
create_worktree.sh), and initialization of autonomous agent sessions (humanlayer launch). - Sanitization: No explicit sanitization or escaping mechanisms are defined for the data extracted from plan files before it is interpolated into command arguments.
Audit Metadata