worktree-manager
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using dynamic inputs provided by the user (such as ticket IDs and descriptions). Specifically, inputs are interpolated directly into
git worktree,ddev, andnpmcommands. There are no instructions for the agent to validate or sanitize these strings to prevent shell metacharacters from altering the intended command execution. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data (user inputs, task IDs, and potentially Teamwork URLs) and uses that data to drive high-capability tools like Bash and Git.
- Ingestion points: User-supplied ticket IDs, short descriptions, and URLs provided in the command arguments or processed from task management links (SKILL.md).
- Boundary markers: None. The skill does not define delimiters or instruct the agent to ignore instructions embedded within the processed data.
- Capability inventory: The skill uses shell execution for
git fetch,git worktree,ddev start,ddev composer install,ddev delete, andnpm install(SKILL.md). - Sanitization: Absent. There are no guidelines provided to the agent for escaping or filtering the external content before interpolation into the prompt/command context.
Audit Metadata