worktree
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform various shell operations using
pnpm,git,gh, andstripeto create, manage, and tear down development environments. - [EXTERNAL_DOWNLOADS]: The CLI tool can automatically install missing development dependencies (like Bun, Node.js, and pnpm) when invoked with the
--yesflag. It also utilizes Cloudflare tunnels (*.trycloudflare.com) to allow external services to interact with local development servers. - [CREDENTIALS_UNSAFE]: The documentation mentions the use of sensitive keys like
STRIPE_SECRET_KEYand requires authenticated CLI sessions. It correctly instructs the agent to ensure these are stored in local.envfiles rather than being hardcoded. - [PROMPT_INJECTION]: The skill includes behavioral guidelines for the agent, such as enforcing the use of worktrees for significant changes and requiring user confirmation before starting new environments.
Audit Metadata