kmcp-dev-worktree-env
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill mentions executing local shell scripts such as
./scripts/deploy-copy-env-from-main.shand npm lifecycle scripts (e.g.,npm run dev:deploy). These are standard operations for development workflows within the repository and do not involve untrusted remote code. - [CREDENTIALS_UNSAFE]: The instructions discuss the handling of
.envfiles, which contain sensitive application secrets. The described behavior is limited to local file system operations (copying configuration between git checkouts on the same host) and follows standard secret management practices without hardcoding or exfiltrating credentials.
Audit Metadata