using-git-worktrees
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Automates the creation and management of Git worktrees using commands such as 'git worktree add' and 'git check-ignore' to ensure proper isolation and prevent repository pollution.
- [EXTERNAL_DOWNLOADS]: Detects project manifest files (package.json, Cargo.toml, requirements.txt, pyproject.toml, go.mod) and triggers dependency installation via standard package managers (npm, cargo, pip, poetry, go mod).
- [COMMAND_EXECUTION]: Executes project-specific test suites (npm test, cargo test, pytest, go test) to verify that the isolated workspace is in a clean state before feature development begins.
- [PROMPT_INJECTION]: Identifies an indirect prompt injection surface as the skill processes project-controlled files to derive execution commands. 1. Ingestion points: CLAUDE.md, package.json, Cargo.toml, requirements.txt, pyproject.toml, go.mod. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution for project setup and testing. 4. Sanitization: Absent. Note: This surface is inherent to development tools and is considered safe within the primary use case of isolated environment setup.
Audit Metadata