worktree-agent

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes Git commands (git worktree, git checkout, git add) and shell scripts (worktree-preflight.sh, worktree-cleanup.sh) to maintain isolated development environments. These are necessary for the skill's stated purpose of worktree management.\n- [INDIRECT_PROMPT_INJECTION]: The worktree_capacity.py script represents a potential ingestion surface as it parses the output of git worktree list --porcelain. Mandatory evidence chain:\n
  • Ingestion points: Raw porcelain output from the local Git binary (scripts/worktree_capacity.py).\n
  • Boundary markers: None present.\n
  • Capability inventory: The skill can perform file staging, branch deletion, and sparse checkouts within the repository.\n
  • Sanitization: The script includes a critical safety check in agent_worktree_paths that resolves found paths and ensures they are relative to the designated .claude/worktrees root, effectively blocking path traversal attempts via maliciously named worktrees.\n- [DYNAMIC_EXECUTION]: The included test script scripts/tests/test_worktree_capacity.py uses importlib.util to dynamically load and execute the worktree_capacity.py module. While dynamic loading can be a risk, this occurrence is limited to development testing of local skill files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 01:19 PM