close-github-worktree-done
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local git commands such as
git worktree list,git branch, andgit fetchto manage the local development environment. It also invokes local PowerShell and Bash scripts located in the skill directory (.cursor/skills/github-worktree/scripts/) to perform worktree removal tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local repository state and user input to determine target directories and parse GitHub issue numbers.
- Ingestion points: Branch names are retrieved from
git worktree listor provided directly by the user. - Boundary markers: The skill uses double quotes to wrap shell variables (e.g.,
"<TARGET_ROOT>"and"<目标分支名>") when executing commands, which helps prevent basic command injection. - Capability inventory: File system modifications (removing worktrees and branches) and network operations (git fetch and GitHub API calls via the user-github MCP server).
- Sanitization: The logic includes specific parsing for numeric issue IDs and mandates explicit user confirmation before deleting worktrees with uncommitted changes or branches that haven't been merged into master.
Audit Metadata