finish-worktree
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill includes instructions to execute a specific Python script found within the local repository directory if it is present.
- Evidence: In SKILL.md, Step 3 specifies: 'If .codestable/tools/codestable-finish-worktree.py exists and the user is finishing an implementation unit, run the project finish gate before cleanup'.
- Context: While common in developer workflows, this allows the execution of code provided by the repository itself, which could be malicious if the project files are untrusted.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the local repository that could contain instructions designed to influence the agent.
- Ingestion points: Data enters the agent's context through 'git status' output, file diffs processed via the '$commit' tool, and the output generated by the project finish gate script.
- Boundary markers: Absent. The skill does not define delimiters or specific 'ignore instructions' warnings for content retrieved from the repository.
- Capability inventory: Shell command execution ('git') and Python script execution.
- Sanitization: Absent. No mention of filtering, escaping, or validating the content read from the file system before it is processed.
Audit Metadata