worktree-manager

SUSPICIOUS: the core capabilities mostly fit a worktree-management skill, and data stays local, but the skill normalizes pre-execution local reads and repeatedly tells the agent to run with --dangerously-skip-permissions. That combination creates a materially elevated security risk even without clear exfiltration or confirmed malware.

The code appears to be a legitimate developer workflow launcher rather than malware. It contains significant command-injection risk because configuration values and several command-line or Git-derived strings are inserted into shell and AppleScript commands without safe quoting. The default --dangerously-skip-permissions setting further increases the consequences of executing an unintended command. Treat config.json and all launcher inputs as fully trusted, or redesign the launcher to use strict validation and safe argument passing.

The code is a purpose-built destructive cleanup script, and its kill, directory removal, registry modification, and optional branch deletion behavior matches its stated purpose. It does not show indicators of malware or covert data theft. However, it has meaningful security risks: unescaped PROJECT and BRANCH values are embedded into jq expressions, registry-controlled paths are trusted by rm -rf and cd, and port values are not validated. Use only with trusted arguments and a trusted registry; add safe jq variable passing, path containment checks, and strict port validation before production use.

This is a worktree registry helper with an intended local filesystem function. It does not show evidence of malware, but it has a real input-handling vulnerability: unescaped arguments are inserted into jq source, and task text is not JSON-escaped. Callers able to control arguments may cause registration failure or manipulate registry contents. Use jq --arg/--argjson for all dynamic values, validate ports and paths, and add locking for concurrent updates.

This is a configuration-only fragment for parallel Git worktree and Claude agent management. It contains no direct evidence of malware, data theft, network exfiltration, persistence, or obfuscated payloads. The main security concern is the configured use of "--dangerously-skip-permissions", which can permit an agent to execute unintended or destructive actions with the user's privileges. The configuration should be treated as high-trust automation and that option should be removed or tightly isolated unless explicitly required.