worktree
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The agent is instructed to use the
pnpm worktreeCLI command, which executes local repository-hosted TypeScript scripts (scripts/worktree/cli.ts) to manage development environment lifecycles and Docker services. - [EXTERNAL_DOWNLOADS]: Automated toolchain provisioning through the
createordoctorcommands (when used with the--yesflag) may download and install well-known development utilities such as Docker, Supabase CLI, Cloudflare Tunnel, and Stripe CLI. - [PROMPT_INJECTION]: The skill architecture presents an indirect prompt injection surface through the processing of repository metadata.
- Ingestion points: Data is ingested from Git branch names, commit messages (used to populate pull request titles and bodies via
gh pr create), and Drizzle migration files. - Boundary markers: The documentation does not specify the use of boundary markers or explicit instructions to the agent to ignore embedded commands within these data sources.
- Capability inventory: The skill possesses capabilities for shell command execution, local filesystem management (Git worktrees), and network operations (Cloudflare tunneling and GitHub repository interaction).
- Sanitization: Input sanitization is not explicitly defined within the skill documentation and is assumed to be handled by the internal logic of the worktree CLI scripts.
Audit Metadata