using-git-worktrees
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage Git state and the local filesystem.
- Uses
git rev-parseto detect isolation state and submodules. - Uses
git worktree addto create new workspaces based on user preference or project defaults. - Uses
ls,cd, andpwdfor directory navigation and existence checks. - Uses
git check-ignoreto ensure worktree directories are correctly excluded from version control. - [EXTERNAL_DOWNLOADS]: The skill automatically triggers package managers to download external dependencies from well-known registries.
- Invokes
npm install,pip install,poetry install,go mod download, andcargo buildbased on project manifest files. - [REMOTE_CODE_EXECUTION]: The skill executes code defined within the project files, which involves inherent risks if the project source is untrusted.
- Running package installation commands (e.g.,
npm install) can execute lifecycle scripts defined in project configuration. - Runs project test suites (e.g.,
npm test,pytest,cargo test) which involve executing the project's own source code and test logic. - Ingestion points: Reads manifests like
package.json,Cargo.toml, andrequirements.txtfrom the project directory. - Capability inventory: Possesses shell access to execute installers and test runners.
- Sanitization: No sanitization is performed on the content of project manifest files before triggering execution.
Audit Metadata