git-worktree
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
worktree-manager.shscript executes several shell commands and Git operations to manage the worktree lifecycle, includinggit worktree,git checkout,git pull, and filesystem operations likemkdirandcp. - [CREDENTIALS_UNSAFE]: The manager script automatically copies sensitive environment files (matching
.env*patterns) from the main repository to newly created worktree paths to ensure configuration parity. This involves accessing files that typically store secrets and credentials. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdinstructions guide the agent to perform dependency installation using package managers such as npm, pip, composer, and go when manifest files are detected in a new worktree, which leads to the downloading of external code from public registries.
Audit Metadata