git-worktree-manager

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The worktree_manager.py and worktree_cleanup.py scripts use subprocess.run to execute various Git commands (e.g., git worktree, git status, git log) and package manager commands (e.g., npm install, pip install). These calls are implemented using list-based arguments without shell=True, which is a standard and secure practice for executing sub-processes.
  • [DATA_EXPOSURE]: The skill includes a feature to synchronize .env files between the main repository and new worktrees. This operation is limited to local file system copies (shutil.copy2) intended to maintain development environment consistency and does not involve any network exfiltration or insecure handling of credentials.
  • [DYNAMIC_EXECUTION]: The skill automates dependency installation via the --install-deps flag. It detects common project lockfiles and executes the appropriate installer (npm, yarn, pnpm, bun, or pip). This behavior is transparently documented and consistent with the skill's purpose as an engineering productivity tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 02:33 PM
Security Audit — agent-trust-hub — git-worktree-manager