laravel-herd-worktrees
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
worktree-new.shscript executescomposer installandnpm/pnpm/yarninstallation commands to fetch project dependencies from established public registries. These operations are a standard part of the Laravel development workflow supported by the skill. - [COMMAND_EXECUTION]: The skill includes bash scripts that automate the execution of various CLI tools:
gitis used for worktree and branch management;php artisancommands are used for Laravel-specific bootstrap tasks like key generation and migrations; database utilities includingmysql,createdb, anddropdbare used to manage isolated databases for each worktree; and theherdCLI is used for local site routing and PHP version isolation. - [INDIRECT_PROMPT_INJECTION]: The skill provides an interface for users to provide branch names and suffixes which are then used to generate file system paths and database names. Ingestion points: Input arguments to
scripts/worktree-new.shandscripts/worktree-rm.sh. Boundary markers: None; inputs are used directly within shell scripts. Capability inventory: File system access, database modification, and execution of build tools. Sanitization: Database names are sanitized usingtrto replace non-alphanumeric characters with underscores. File paths and branch names are double-quoted in shell commands to mitigate basic shell expansion.
Audit Metadata