worktree-execution
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell scripts (
worktree-create.shandworktree-cleanup.sh) that use standard git commands (git worktree add,git worktree remove,git worktree lock). The scripts include robust security controls: - Path Validation: All worktree paths are strictly validated to exist within the system temporary directory (
/tmp) and must follow theworktree-rashomon-*naming convention. - Argument Sanitization: Label arguments are checked against a whitelist of characters (alphanumeric, dot, underscore, and hyphen) to prevent command injection.
- Least Privilege: The scripts operate on specific detached HEAD commits and use the
git worktree lockfeature to prevent accidental deletion or interference with other system processes. - Automated Cleanup: Includes orphan detection that removes expired or abandoned worktrees based on owner PID status or lease expiry timestamps.
Audit Metadata