using-git-worktrees

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage Git state and the local filesystem.
  • Uses git rev-parse to detect isolation state and submodules.
  • Uses git worktree add to create new workspaces based on user preference or project defaults.
  • Uses ls, cd, and pwd for directory navigation and existence checks.
  • Uses git check-ignore to ensure worktree directories are correctly excluded from version control.
  • [EXTERNAL_DOWNLOADS]: The skill automatically triggers package managers to download external dependencies from well-known registries.
  • Invokes npm install, pip install, poetry install, go mod download, and cargo build based on project manifest files.
  • [REMOTE_CODE_EXECUTION]: The skill executes code defined within the project files, which involves inherent risks if the project source is untrusted.
  • Running package installation commands (e.g., npm install) can execute lifecycle scripts defined in project configuration.
  • Runs project test suites (e.g., npm test, pytest, cargo test) which involve executing the project's own source code and test logic.
  • Ingestion points: Reads manifests like package.json, Cargo.toml, and requirements.txt from the project directory.
  • Capability inventory: Possesses shell access to execute installers and test runners.
  • Sanitization: No sanitization is performed on the content of project manifest files before triggering execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 01:43 PM
Security Audit — agent-trust-hub — using-git-worktrees