git-worktrees
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection via the task_name and base_branch parameters in the WorktreeManager class and bash examples. An attacker could potentially supply branch names with command flags to alter the behavior of git commands. \n
- Ingestion points: task_name and base_branch arguments in the WorktreeManager.create method and bash commands (SKILL.md). \n
- Boundary markers: Absent. The parameters are directly interpolated into the command argument list. \n
- Capability inventory: Execution of system commands via subprocess.run and terminal interaction. \n
- Sanitization: Absent; the skill assumes inputs are well-formed branch and directory names. \n- [DYNAMIC_EXECUTION]: The Python implementation in SKILL.md uses subprocess.run to execute git commands. While it utilizes a list for arguments to mitigate shell-injection, the command structure is dynamically constructed based on user-provided variables like task names and paths. \n- [COMMAND_EXECUTION]: The skill describes the use of system commands including git, npm install, and npm ci. These operations involve executing local tools and package managers that may interact with external registries.
Audit Metadata