Skip to content
skillsafebeta
← Report library
Purpose / Development

Using Git Worktrees Skill Security Audit

What the author says it does (original text)

Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback

Independent security check

Do not install or run it yet

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
High risk

Automatic install, build, and test steps execute unreviewed project or dependency code

Source references: 2
What we found

When common manifest files are present, the Skill instructs the agent to run npm install, cargo build, pip/poetry install, or go mod download, followed by tests. Install lifecycle scripts, Rust build.rs files, build logic, and tests can execute arbitrary code supplied by the repository or downloaded dependencies, without a separate confirmation or a restriction that disables scripts.

Why this matters

A malicious or compromised repository or dependency could read or alter accessible files, invoke local tools, or use whatever network access the package manager receives. Worktree isolation does not isolate process permissions, credentials, or data outside the worktree.

When manifest files are detected, the instructions automatically run dependency installation or builds and then project tests. `npm install` can trigger lifecycle scripts, `cargo build` can run build.rs, and Python installation and tests can execute repository or dependency code. No separate confirmation or script-disablement is required. `go mod download` normally only downloads modules, so not every listed command carries the same execution risk.

SKILL.md:104In the instructionsOpen original file
Auto-detect and run appropriate setup:```bash# Node.jsif [ -f package.json ]; then npm install; fi# Rustif [ -f Cargo.toml ]; then cargo build; fi# Pythonif [ -f requirements.txt ]; then pip install -r requirements.txt; fiif [ -f pyproject.toml ]; then poetry install; fi# Goif [ -f go.mod ]; then go mod download; fi```
Show 1 other places
SKILL.md:123In the instructionsOpen original file
Run tests to ensure workspace starts clean:```bash# Use project-appropriate commandnpm test / cargo test / pytest / go test ./...```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
Medium risk

The Skill automatically modifies and commits .gitignore when the directory is not ignored

Source references: 2
What we found

Consent to create an isolated worktree is extended into modifying the repository and creating a commit. The instructions do not require showing the change, confirming its contents, or obtaining separate approval. This is a persistent history change rather than a trace-free temporary workspace operation.

Why this matters

The user’s branch may receive an unplanned .gitignore change and commit, affecting later merges, reviews, and shared history. If the environment or branch was identified incorrectly, the change could also land on a branch the user did not intend to modify.

The Skill first seeks consent to create an isolated worktree, but if the local worktree directory is not ignored, it then mandates editing `.gitignore` and creating a commit. This persistent repository-history change has no separate confirmation or review requirement, so workspace consent may be extended into an unexpected repository modification. A user could require renewed confirmation or an out-of-repository location.

SKILL.md:78In the instructionsOpen original file
#### Safety Verification (project-local directories only)**MUST verify directory is ignored before creating worktree:**```bashgit check-ignore -q .worktrees 2>/dev/null || git check-ignore -q worktrees 2>/dev/null```**If NOT ignored:** Add to .gitignore, commit the change, then proceed.**Why critical:** Prevents accidentally committing worktree contents to repository.
Show 1 other places
SKILL.md:41In the instructionsOpen original file
Has the user already indicated their worktree preference in your instructions? If not, ask for consent before creating a worktree:> "Would you like me to set up an isolated worktree? It protects your current branch from changes."Honor any existing declared preference without asking. If the user declines consent, work in place and skip to Step 2.
Medium risk

A failed worktree creation falls back to the user’s current checkout

Source references: 3
What we found

When the sandbox denies worktree creation, the Skill explicitly continues setup and baseline tests in the current directory. The earlier consent concerns an “isolated worktree,” while this fallback requires notification but not the user’s approval to run subsequent operations in the original checkout.

Why this matters

Files generated by installation, builds, or tests, lockfile changes, and other side effects may appear in the user’s existing workspace, defeating the promised isolation and potentially mixing with uncommitted work.

If the sandbox denies worktree creation, the instructions require only notifying the user before running setup and tests in the current checkout; renewed consent is not required. Setup can install dependencies, execute build scripts, or alter lock/generated files, so this abandons the isolation boundary to which the user originally agreed. A user could require the Skill to pause and ask again after such a failure.

SKILL.md:100In the instructionsOpen original file
**Sandbox fallback:** If `git worktree add` fails with a permission error (sandbox denial), tell the user the sandbox blocked worktree creation and you're working in the current directory instead. Then run setup and baseline tests in place.
Show 2 other places
SKILL.md:41In the instructionsOpen original file
Has the user already indicated their worktree preference in your instructions? If not, ask for consent before creating a worktree:> "Would you like me to set up an isolated worktree? It protects your current branch from changes."Honor any existing declared preference without asking. If the user declines consent, work in place and skip to Step 2.
SKILL.md:104In the instructionsOpen original file
Auto-detect and run appropriate setup:```bash# Node.jsif [ -f package.json ]; then npm install; fi# Rustif [ -f Cargo.toml ]; then cargo build; fi# Pythonif [ -f requirements.txt ]; then pip install -r requirements.txt; fiif [ -f pyproject.toml ]; then poetry install; fi# Goif [ -f go.mod ]; then go mod download; fi```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

The Skill first compares Git’s directory with its common directory and checks for a submodule, aiming to avoid creating another worktree inside an existing linked worktree.

View source
SKILL.md:20In the instructionsOpen original file
```bashGIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)BRANCH=$(git branch --show-current)```
SKILL.md:28In the instructionsOpen original file
```bash# If this returns a path, you're in a submodule, not a worktree — treat as normal repogit rev-parse --show-superproject-working-tree 2>/dev/null```
SKILL.md:33In the instructionsOpen original file
**If `GIT_DIR != GIT_COMMON` (and not a submodule):** You are already in a linked worktree. Skip to Step 2 (Project Setup). Do NOT create another worktree.

If no preference has already been declared, the Skill requires user consent first. It prefers a native worktree facility and otherwise runs git worktree add to create a new branch.

View source
SKILL.md:41In the instructionsOpen original file
Has the user already indicated their worktree preference in your instructions? If not, ask for consent before creating a worktree:> "Would you like me to set up an isolated worktree? It protects your current branch from changes."Honor any existing declared preference without asking. If the user declines consent, work in place and skip to Step 2.
SKILL.md:53In the instructionsOpen original file
The user has asked for an isolated workspace (Step 0 consent). Do you already have a way to create a worktree? It might be a tool with a name like `EnterWorktree`, `WorktreeCreate`, a `/worktree` command, or a `--worktree` flag. If you do, use it and skip to Step 2.Native tools handle directory placement, branch creation, and cleanup automatically. Using `git worktree add` when you have a native tool creates phantom state your harness can't see or manage.Only proceed to Step 1b if you have no native worktree tool available.
SKILL.md:92In the instructionsOpen original file
```bash# Determine path based on chosen locationpath="$LOCATION/$BRANCH_NAME"git worktree add "$path" -b "$BRANCH_NAME"cd "$path"```

After worktree creation, the Skill automatically installs or builds dependencies based on project manifests and then runs applicable tests. Its behavior therefore goes beyond workspace isolation and executes code supplied by the project and its dependencies.

View source
SKILL.md:102In the instructionsOpen original file
## Step 2: Project SetupAuto-detect and run appropriate setup:```bash# Node.jsif [ -f package.json ]; then npm install; fi# Rustif [ -f Cargo.toml ]; then cargo build; fi# Pythonif [ -f requirements.txt ]; then pip install -r requirements.txt; fiif [ -f pyproject.toml ]; then poetry install; fi# Goif [ -f go.mod ]; then go mod download; fi```
SKILL.md:121In the instructionsOpen original file
## Step 3: Verify Clean BaselineRun tests to ensure workspace starts clean:```bash# Use project-appropriate commandnpm test / cargo test / pytest / go test ./...```
Start here · InstructionsSKILL.md
using-git-worktrees
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:20In the instructionsOpen original file
```bashGIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
SKILL.md:28In the instructionsOpen original file
```bash# If this returns a path, you're in a submodule, not a worktree — treat as normal repo
SKILL.md:70In the instructionsOpen original file
2. **Check for an existing project-local worktree directory:**   ```bash   ls -d .worktrees 2>/dev/null     # Preferred (hidden)
Install extra software packages
SKILL.md:108In the instructionsOpen original file
# Node.jsif [ -f package.json ]; then npm install; fi
SKILL.md:114In the instructionsOpen original file
# Pythonif [ -f requirements.txt ]; then pip install -r requirements.txt; fiif [ -f pyproject.toml ]; then poetry install; fi
Lines read
168
File checksum (to compare versions)
02921034d1e3608664d3a1fd0fd2c35d3893b14479a3d488870ccb3628e5d356