worktree-workflow
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill does not contain any malicious patterns, obfuscation, or unauthorized access attempts. Its behavior is consistent with its stated purpose of managing git workflows.
- [COMMAND_EXECUTION]: The scripts
regular-commit.shandstart-task-worktree.shexecute localgitcommands to manage worktrees, commit changes, and initialize submodules. Input parameters like task names are sanitized usingtrto prevent shell injection or malformed file paths. - [EXTERNAL_DOWNLOADS]: The skill may trigger the download of external code via
git submodule update --init --recursive. This is a standard operation within git repositories to manage dependencies. - [DATA_EXFILTRATION]: The skill includes a
git pushoperation to the user's configuredoriginremote. This is an intentional feature designed to synchronize local work with the remote repository as part of the task workflow.
Audit Metadata