environments-manager

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates and executes local shell scripts (worktree-up.sh, worktree-down.sh, dev.sh) to manage the development lifecycle. These scripts use standard system utilities like git, cd, cp, sed, and lsof for local environment preparation.
  • [EXTERNAL_DOWNLOADS]: The generated setup scripts utilize package managers (npm, pnpm, yarn, bun) to install project dependencies from official registries. It also references tools like nvm and fnm for Node.js version management, which is standard for development environments.
  • [COMMAND_EXECUTION]: Dynamic modification of local environment files (.env) is performed using sed to isolate database connections. The skill generates specific logic to update DATABASE_URL with a worktree-specific suffix to prevent data collision between parallel worktrees.
  • [SAFE]: The skill implements a 'Production Guard' mechanism to prevent destructive operations on production-named resources. It includes a function that checks for 'prod' or 'production' strings in deployment references and aborts if detected unless explicitly overridden by the user.
  • [SAFE]: Security best practices for secret management are emphasized. The instructions explicitly warn against logging or committing sensitive data discovered in .env files and recommend the use of .worktreeinclude to handle environment file duplication natively within the IDE's security context.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 04:32 PM
Security Audit — agent-trust-hub — environments-manager