wt-create

No clear malware or supply-chain payload is present. The code is primarily a Git worktree management tool. The main security risk is intentional shell execution of post_create commands from a repository-controlled YAML configuration, combined with inheritance of most environment variables. It should only be used with trusted repositories and configuration; hooks should ideally use an argument list rather than shell=True and a restricted environment.