git-worktree-manager
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
worktree_manager.pyandworktree_cleanup.pyscripts usesubprocess.runto execute various Git commands (e.g.,git worktree,git status,git log) and package manager commands (e.g.,npm install,pip install). These calls are implemented using list-based arguments withoutshell=True, which is a standard and secure practice for executing sub-processes. - [DATA_EXPOSURE]: The skill includes a feature to synchronize
.envfiles between the main repository and new worktrees. This operation is limited to local file system copies (shutil.copy2) intended to maintain development environment consistency and does not involve any network exfiltration or insecure handling of credentials. - [DYNAMIC_EXECUTION]: The skill automates dependency installation via the
--install-depsflag. It detects common project lockfiles and executes the appropriate installer (npm,yarn,pnpm,bun, orpip). This behavior is transparently documented and consistent with the skill's purpose as an engineering productivity tool.
Audit Metadata