github-worktree
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various system commands including
git,powershell,bash, and thecursoreditor CLI. It also runs local scripts provided within the skill package to manage worktree creation and file synchronization. - [EXTERNAL_DOWNLOADS]: During its operation, the skill performs
git fetchto update the local repository from GitHub. It also executes./gradlew(orgradlew.bat), which typically downloads necessary build dependencies and the Gradle wrapper from remote servers. - [PROMPT_INJECTION]: The skill ingests data from GitHub issue titles and labels. These strings are used to derive branch names and issue descriptions. The associated scripts include sanitization logic (e.g., the
get_branch_path_namefunction) to strip or replace characters that could cause formatting issues or command injection before they are used in shell command interpolation.
Audit Metadata