prd-worktree
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues or malicious patterns were detected during the analysis of the skill's instructions and accompanying shell script.
- [COMMAND_EXECUTION]: The skill facilitates git worktree management by executing local commands (
git,bash,cp). These are core to the stated purpose of the skill and are implemented using a helper script that sanitizes user-provided inputs. - [DATA_EXFILTRATION]: The skill includes a step to copy a local configuration file (
settings.local.json) to the newly created worktree. This is a local file system operation intended to maintain the user's development environment and does not involve any external network communication or exfiltration of sensitive data. - [PROMPT_INJECTION]: The skill processes Product Requirements Documents (PRDs) and user input to generate branch names. The included
create.shscript employs robust sanitization (removing special characters and formatting as a slug) before incorporating this data into shell commands, effectively mitigating the risk of indirect or direct injection through these fields.
Audit Metadata