worktree
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to interact with the local operating system by executing Git CLI commands and navigating directories to manage parallel work environments.
- Evidence: Execution of commands such as
git worktree add,git branch -d,git push, andcddocumented throughoutSKILL.md. - Safety context: The skill enforces a safety policy requiring the agent to obtain explicit user confirmation before executing any deletion commands (
git worktree remove,git branch -d, etc.). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied task descriptions to generate branch names and directory paths, which are then used in shell commands.
- Ingestion points: User-provided task names are ingested to form directory names like
../.wt-<task>and branch names likefeature/wx-<task>. - Boundary markers: The skill includes a mandatory instruction that "一切删除动作执行前必须先向用户确认" (all deletion actions must first be confirmed by the user).
- Capability inventory: The skill utilizes subprocess execution of Git commands and file system navigation via
cdinSKILL.md. - Sanitization: No explicit shell-escaping or validation logic for the task names is defined in the instructions, relying on the user confirmation step for safety.
Audit Metadata