ia-git-worktree

• Outcome: Pass
• Latest audit: Oct 12, 2026 · 2:23 PM UTC
• Version: 5.1.1

Overview

This is a coherent Git worktree utility, with the main caution that it can duplicate local .env files into new trusted worktrees.

Install only if you want an agent to manage Git worktrees for you. Use --no-env for PRs, forks, third-party code, or any branch where duplicated secrets are not necessary, and remember that copied .env files and installed dependencies remain on disk until you explicitly dispose of them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill explicitly supports copying .env files into worktrees, and those files commonly contain secrets such as API keys, database passwords, and tokens. Even though the text includes some safeguards, duplicating credential-bearing files across additional checkouts expands secret exposure, risks accidental execution against copied credentials, and increases the chance of leakage through logs, tests, commits, or compromised dependency scripts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

| `create [--no-env] <branch> [from]` | Create worktree + branch (default: from main) | `...worktree-manager.sh create feature-login` |
| `list` / `ls` | List all worktrees with status | `...worktree-manager.sh list` |
| `switch <name>` / `go` | Print the registered worktree's absolute path; the caller applies it as workdir | `target=$(...worktree-manager.sh switch feature-login)` |
| `copy-env <name>` | Copy .env files to existing worktree | `...worktree-manager.sh copy-env feature-login` |
| `cleanup <name> [...]` / `clean` | Confirm removal of named, session-owned, clean worktrees | `...worktree-manager.sh cleanup feature-login` |

Run commands with `env -C "$target" <command>` or the harness workdir argument. A child script cannot change the caller's working directory. Listing and name resolution work from any main or linked checkout, including subdirectories.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

- [hooks-and-excludes.md](./references/hooks-and-excludes.md) - Hook safety under Husky, .git/info/exclude vs .gitignore

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

, review/work workflows, branch completion, or hooks: [worktree-integration.md](./references/worktree-integration.md).

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SPEC.md (reported line 16)May include surrounding context.

md

Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->

## Trigger Context

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 25)May include surrounding context.

bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh list

text

### .env files missing in worktree?

If a worktree was created without .env files (e.g., via raw `git worktree add`, `--no-env`, or a base that is not a local or `origin` branch), copy them only when the tree holds no third-party code; never copy into a PR or fork review tree. Existing files and symlinks in the worktree are skipped, not overwritten; remove a stale copy first to refresh it:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 27)May include surrounding context.

bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh list

text

### .env files missing in worktree?

If a worktree was created without .env files (e.g., via raw `git worktree add`, `--no-env`, or a base that is not a local or `origin` branch), copy them only when the tree holds no third-party code; never copy into a PR or fork review tree. Existing files and symlinks in the worktree are skipped, not overwritten; remove a stale copy first to refresh it:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/worktree-manager.sh (reported line 104)May include surrounding context.

sh

bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh list
```

### .env files missing in worktree?

If a worktree was created without .env files (e.g., via raw `git worktree add`, `--no-env`, or a base that is not a local or `origin` branch), copy them only when the tree holds no third-party code; never copy into a PR or fork review tree. Existing files and symlinks in the worktree are skipped, not overwritten; remove a stale copy first to refresh it:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/worktree-manager.sh (reported line 251)May include surrounding context.

sh

bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh list
```

### .env files missing in worktree?

If a worktree was created without .env files (e.g., via raw `git worktree add`, `--no-env`, or a base that is not a local or `origin` branch), copy them only when the tree holds no third-party code; never copy into a PR or fork review tree. Existing files and symlinks in the worktree are skipped, not overwritten; remove a stale copy first to refresh it:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/worktree-manager.sh (reported line 255)May include surrounding context.

sh

bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh list
```

### .env files missing in worktree?

If a worktree was created without .env files (e.g., via raw `git worktree add`, `--no-env`, or a base that is not a local or `origin` branch), copy them only when the tree holds no third-party code; never copy into a PR or fork review tree. Existing files and symlinks in the worktree are skipped, not overwritten; remove a stale copy first to refresh it:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/worktree-manager.sh (reported line 390)May include surrounding context.

sh

bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh list
```

### .env files missing in worktree?

If a worktree was created without .env files (e.g., via raw `git worktree add`, `--no-env`, or a base that is not a local or `origin` branch), copy them only when the tree holds no third-party code; never copy into a PR or fork review tree. Existing files and symlinks in the worktree are skipped, not overwritten; remove a stale copy first to refresh it:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

This example encourages creating a new worktree in a mode that copies .env files, which can expose credentials to additional directories, tools, and processes associated with the new checkout. In the context of parallel feature work, this broadens the attack surface for secrets even if the branch itself is trusted, and can lead to credential compromise through accidental commit, indexing, backup, or local malware access.

Content

Scanner excerpt · references/workflow-examples.md (reported line 42)May include surrounding context.

Parallel Feature Development

bash

# For first feature (copies .env files; main is the default branch):
export WORKTREE_SESSION_ID="$(python3 -I -c 'import uuid; print(uuid.uuid4())')"
bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh create feature-login

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

The second example repeats the pattern of creating another worktree that also copies .env files, multiplying the number of credential-bearing locations on disk. Repetition in workflow documentation makes unsafe secret handling more likely to be adopted as normal practice, increasing the probability of credential leakage over time.

Content

Scanner excerpt · references/workflow-examples.md (reported line 46)May include surrounding context.

md

export WORKTREE_SESSION_ID="$(python3 -I -c 'import uuid; print(uuid.uuid4())')"
bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh create feature-login

# Later, start second feature (also copies .env files):
bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh create feature-notifications

# List what you have:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill instructs network-capable operations such as fetching from origin and installing dependencies, but it declares no explicit tool scope or allowed-tools boundary. In an agent environment, missing scope constraints can let the skill invoke broader networked actions than intended, increasing the chance of unauthorized remote access, dependency retrieval, or interaction with untrusted repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples explicitly state that .env files are copied into additional worktrees, which duplicates secrets across multiple filesystem locations and increases the chance of accidental disclosure, inclusion in logs/backups, or leakage from less-trusted review environments. Although this is documentation rather than code that directly exfiltrates credentials, the workflow normalizes secret propagation without a clear warning or safer default.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The help text states that newly copied .env files are mode 600, but copy_env_files creates them via mktemp and mv without explicitly chmod'ing the final destination. In practice, the resulting permissions depend on the process umask and mktemp behavior, so sensitive credentials may be left readable by other local users contrary to operator expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.