ce-clean-gone-branches
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several local
gitcommands to manage the repository state. git fetch --pruneis used to update the local tracking info.git branch -vvis parsed by a local script to identify branches marked as 'gone'.git worktree removeandgit branch -Dare used to perform cleanups.- All destructive operations are explicitly gated by a user confirmation step to prevent unintended data loss.
- [EXTERNAL_DOWNLOADS]: The skill performs a
git fetchoperation to synchronize with the remote repository. This is a standard and expected behavior for a branch management tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes branch names originating from a remote repository, which represents a potential injection surface.
- Ingestion points: Branch names are fetched from the remote and parsed in
scripts/clean-gone. - Boundary markers: The skill presents the list to the user for confirmation but does not use specific delimiters or instructions to the agent to ignore embedded commands in branch names.
- Capability inventory: The agent has the capability to delete files via
git branch -Dandgit worktree remove. - Sanitization: The helper script validates that branch names are not empty and do not look like raw hashes, providing basic structural validation.
Audit Metadata