skills/kortix-ai/suna/worktree/Gen Agent Trust Hub

worktree

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The agent is instructed to use the pnpm worktree CLI command, which executes local repository-hosted TypeScript scripts (scripts/worktree/cli.ts) to manage development environment lifecycles and Docker services.
  • [EXTERNAL_DOWNLOADS]: Automated toolchain provisioning through the create or doctor commands (when used with the --yes flag) may download and install well-known development utilities such as Docker, Supabase CLI, Cloudflare Tunnel, and Stripe CLI.
  • [PROMPT_INJECTION]: The skill architecture presents an indirect prompt injection surface through the processing of repository metadata.
  • Ingestion points: Data is ingested from Git branch names, commit messages (used to populate pull request titles and bodies via gh pr create), and Drizzle migration files.
  • Boundary markers: The documentation does not specify the use of boundary markers or explicit instructions to the agent to ignore embedded commands within these data sources.
  • Capability inventory: The skill possesses capabilities for shell command execution, local filesystem management (Git worktrees), and network operations (Cloudflare tunneling and GitHub repository interaction).
  • Sanitization: Input sanitization is not explicitly defined within the skill documentation and is assumed to be handled by the internal logic of the worktree CLI scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 12:11 AM
Security Audit — agent-trust-hub — worktree