Using Git Worktrees
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage git worktrees (
git worktree add) and project setup tasks (npm install,cargo build,pip install,poetry install,go mod download). - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the project environment which acts as a vulnerability surface for indirect injection:
- Ingestion points: The skill reads directory preferences from
CLAUDE.md(via grep) and uses the user-provided$BRANCH_NAME(passed via the agent context) to construct shell commands. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when the agent processes these inputs.
- Capability inventory: The skill utilizes subprocess calls for git operations, package management (network-enabled), and test execution.
- Sanitization: There is no evidence of sanitization or validation of the branch name or
CLAUDE.mdcontent before interpolation into shell execution strings. - [DYNAMIC_EXECUTION]: Shell commands and file paths are dynamically assembled at runtime using variable interpolation (e.g.,
$BRANCH_NAME,$LOCATION, and$project). While these are intended to be local workspace identifiers, they are executed as part of shell strings without strict validation.
Audit Metadata