git-worktree-manager
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The provided scripts use the
subprocess.runmodule to interact with Git and package managers. All calls use list-based arguments rather than shell strings, which is a secure implementation that prevents shell injection vulnerabilities.- [EXTERNAL_DOWNLOADS]: The skill includes an optional dependency installation feature that can be triggered via a CLI flag. This feature utilizes standard system package managers (e.g., npm, pip, yarn) to install dependencies defined in the project's own lockfiles.- [DATA_EXFILTRATION]: The tool automates the synchronization of local environment variables by copying.envfiles from the main repository to the new worktree directory. This data remains on the local filesystem, and no network operations are present in the code to transmit this data externally.
Audit Metadata