worktree
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Git commands through the shell to perform worktree operations including add, list, remove, and prune.
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to potential indirect prompt injection because it incorporates external inputs into shell commands.
- Ingestion points: User-supplied
<branch>and<base_ref>values are used to construct Git commands in SKILL.md. - Boundary markers: There are no explicit instructions or delimiters to protect the shell command structure from malicious input.
- Capability inventory: The agent can execute commands and alter the repository structure using the worktree functionality as defined in SKILL.md.
- Sanitization: The instructions do not provide mechanisms to sanitize or validate the input strings to prevent shell command injection.
Audit Metadata