worktree-discipline
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill heavily utilizes shell commands and local repository scripts to manage the project state. It includes commands for git worktree management (
git worktree add), directory navigation, and the execution of project-specific scripts like.guardrails/scripts/task-worktree.shandnew-id.sh. These actions are necessary for the skill's primary function of change isolation.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a communication protocol where a dispatcher agent consumes output from a subagent to proceed with repository operations. This creates a potential surface for indirect prompt injection if subagent output is manipulated.\n - Ingestion points: The dispatcher reads the
worktree:path and task tagt<N>from a subagent's report as described inSKILL.mdstep 8.\n - Boundary markers: No specific delimiters or safety instructions are provided to separate the untrusted report data from the dispatcher's execution context.\n
- Capability inventory: The dispatcher uses the ingested tag to execute shell commands such as
sh .guardrails/scripts/task-worktree.sh merge t<N>.\n - Sanitization: The instructions do not specify any validation or sanitization steps for the data received from the subagent before it is used in shell commands. This is noted as a vulnerability surface inherent to the multi-agent coordination protocol described in the skill.
Audit Metadata