clean-gone-branches
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to discover and delete Git branches and worktrees. While these are destructive operations, the skill mandates a human-in-the-loop confirmation step to mitigate risk.
- [INDIRECT_PROMPT_INJECTION]: The skill parses output from
git branch -vv, which includes information tracking remote branches. This presents an attack surface where a maliciously named remote branch could attempt to influence the agent's behavior during the deletion phase.\n - Ingestion points: The
scripts/clean-gonescript reads tracking information derived from the remote repository.\n - Boundary markers: The skill explicitly requires the use of platform blocking tools (such as
AskUserQuestion) to get user confirmation for the full list of branches before proceeding.\n - Capability inventory: The agent has the capability to remove worktrees (
git worktree remove --force) and delete local branches (git branch -D) as described inSKILL.md.\n - Sanitization: The discovery script
scripts/clean-goneperforms basic sanitization by excluding the current branch and theHEADreference, while ensuring branch names are properly extracted without whitespace usingawkandsed.
Audit Metadata