using-git-worktrees
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell and Git commands to manage the development environment and perform setup tasks.
- Detects repository status using
git rev-parseandgit branch. - Creates isolated worktrees using
git worktree add. - Executes project-specific test runners such as
npm test,cargo test,pytest, andgo test. - [EXTERNAL_DOWNLOADS]: The skill invokes standard package managers to install dependencies defined within the project.
- Detects project configuration files and executes
npm install,pip install,cargo build,poetry install, andgo mod downloadas needed. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the local repository environment to determine its execution flow.
- Ingestion points: Local project metadata files (e.g., package.json, requirements.txt) and Git branch information in
SKILL.md. - Boundary markers: No specific delimiters are used to separate repository data from instructions.
- Capability inventory: The skill has the ability to execute arbitrary commands via package scripts and test runners defined in the local repository.
- Sanitization: No sanitization is applied to project-defined scripts before they are executed by the environment management tools.
Audit Metadata