worktree
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands using
gitandcodegraphwith interpolated variables such as$worktree_branch,$worktree_path, and$worktree_base_oid. While the instructions recommend quoting arguments, this pattern still presents a surface for potential command injection if validation of the variables is bypassed. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and adhere to instructions found in repository files (
AGENTS.override.mdandCLAUDE.local.md) before proceeding with the setup. - Ingestion points:
SKILL.md(Step 3) directs the agent to readAGENTS.override.mdandCLAUDE.local.mdfrom the source repository root. - Boundary markers: No specific delimiters or warnings to ignore embedded instructions are specified for these files.
- Capability inventory: The skill allows for Git operations (fetch, worktree, config), file copying, and CodeGraph initialization.
- Sanitization: The instructions do not mention any sanitization or validation of the content of these instruction files before the agent reads and acts on them.
Audit Metadata