using-git-worktrees
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes native Git commands to detect repository state (
git rev-parse), verify worktree status, and create new worktrees (git worktree add). It also invokes standard build and test tools based on project structure. - [EXTERNAL_DOWNLOADS]: The skill triggers standard package manager commands (
npm install,cargo build,pip install,poetry install,go mod download) to resolve project dependencies. These operations target well-known, official package registries. - [DATA_EXPOSURE]: The skill reads project configuration files and repository metadata to determine the appropriate setup environment. This access is local and necessary for its documented purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes project manifest files (like
package.jsonorrequirements.txt) which are untrusted external data. However, this is an inherent aspect of development tools, and the skill maintains safety by using standard, non-obfuscated commands for these operations.
Audit Metadata