worktree-agent
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Git commands (
git worktree,git checkout,git add) and shell scripts (worktree-preflight.sh,worktree-cleanup.sh) to maintain isolated development environments. These are necessary for the skill's stated purpose of worktree management.\n- [INDIRECT_PROMPT_INJECTION]: Theworktree_capacity.pyscript represents a potential ingestion surface as it parses the output ofgit worktree list --porcelain. Mandatory evidence chain:\n - Ingestion points: Raw porcelain output from the local Git binary (scripts/worktree_capacity.py).\n
- Boundary markers: None present.\n
- Capability inventory: The skill can perform file staging, branch deletion, and sparse checkouts within the repository.\n
- Sanitization: The script includes a critical safety check in
agent_worktree_pathsthat resolves found paths and ensures they are relative to the designated.claude/worktreesroot, effectively blocking path traversal attempts via maliciously named worktrees.\n- [DYNAMIC_EXECUTION]: The included test scriptscripts/tests/test_worktree_capacity.pyusesimportlib.utilto dynamically load and execute theworktree_capacity.pymodule. While dynamic loading can be a risk, this occurrence is limited to development testing of local skill files.
Audit Metadata