using-git-worktrees
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads from
CLAUDE.mdto determine worktree directory preferences, which introduces a surface where malicious instructions could be embedded in the data being processed. - Ingestion points: Reads project-level configuration from
CLAUDE.mdusinggrepinSKILL.md. - Boundary markers: The skill uses pattern matching for specific keywords but lacks explicit delimiters or warnings to ignore instructions within the ingested content.
- Capability inventory: The skill has capabilities to modify the file system, execute Git commands, and run package manager scripts (
npm,cargo,pip,poetry,go) across all scripts. - Sanitization: The ingestion is restricted via
grep, but the extracted content is used directly as a path variable in subsequent shell commands. - [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage Git worktrees and perform standard project initialization and testing.
- Evidence: Instructs the agent to run
git worktree,git check-ignore, and various build/test commands (npm install,cargo build,pip install,poetry install,go mod download) based on the presence of project manifest files.
Audit Metadata