workspace-isolation
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses multiple shell commands to manage the file system, check Git configurations, and create worktrees.
- [REMOTE_CODE_EXECUTION]: The skill automatically triggers package managers (npm, pip, poetry, cargo, go) and test suites (npm test, cargo test, pytest, go test) based on project files. This behavior allows for arbitrary code execution via install scripts or test files if the repository being worked on is malicious.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository environment which can influence its behavior.
- Ingestion points: Configuration preferences are read from CLAUDE.md using grep, and project types are identified by checking for specific file existence.
- Boundary markers: No explicit markers are used to encapsulate or ignore potentially malicious instructions found within the repository's files.
- Capability inventory: The skill leverages shell access to perform dependency installation and system testing.
- Sanitization: Shell variables such as $BRANCH_NAME and $LOCATION are used in shell commands without visible sanitization in the skill instructions, which could lead to command injection if malicious values are supplied.
Audit Metadata