laravel-herd-worktrees

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The worktree-new.sh script executes composer install and npm/pnpm/yarn installation commands to fetch project dependencies from established public registries. These operations are a standard part of the Laravel development workflow supported by the skill.
  • [COMMAND_EXECUTION]: The skill includes bash scripts that automate the execution of various CLI tools: git is used for worktree and branch management; php artisan commands are used for Laravel-specific bootstrap tasks like key generation and migrations; database utilities including mysql, createdb, and dropdb are used to manage isolated databases for each worktree; and the herd CLI is used for local site routing and PHP version isolation.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an interface for users to provide branch names and suffixes which are then used to generate file system paths and database names. Ingestion points: Input arguments to scripts/worktree-new.sh and scripts/worktree-rm.sh. Boundary markers: None; inputs are used directly within shell scripts. Capability inventory: File system access, database modification, and execution of build tools. Sanitization: Database names are sanitized using tr to replace non-alphanumeric characters with underscores. File paths and branch names are double-quoted in shell commands to mitigate basic shell expansion.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:12 PM