pickup
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Orchestrates local git operations including
git worktree list,git status, andgit branchto manage development state across isolated worktrees.\n- [COMMAND_EXECUTION]: Invokes a local shell script at~/.claude/coordination/resolve-coord-dir.shto determine the path for session-specific coordination journals.\n- [DATA_EXFILTRATION]: Instructions include accessing and copying project secrets from files like.envand.dev.varsinto new worktrees for setup; no external network transmission or data exfiltration is initiated.\n- [PROMPT_INJECTION]: Indirect prompt injection surface exists because the skill reads external handoff documentation to resume context.\n - Ingestion points: Reads markdown files from the
handoffs/directory (SKILL.md).\n - Boundary markers: Absent; the skill loads context directly from the documentation without explicit separators.\n
- Capability inventory: Includes file system manipulation (
git worktree add) and shell execution via bash.\n - Sanitization: No validation or sanitization is performed on the content of the handoff files.
Audit Metadata