ia-git-worktree

• Outcome: Review
• Latest audit: Aug 29, 2026 · 10:29 PM UTC
• Version: 4.5.0

Overview

This worktree helper is mostly coherent, but it automatically copies .env files that may contain secrets into new worktrees without an explicit opt-in or warning.

Review this skill before installing if your repositories use .env files for API keys, database passwords, tokens, or other secrets. Prefer changing the script to make env copying opt-in, add a warning, restrict copied files to an allowlist, and avoid creating backup copies of secret files by default.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill’s declared purpose is worktree management, but it also instructs the manager script to copy .env files, modify .gitignore, install dependencies, and fetch from origin. Those side effects expand the trust boundary beyond simple git worktree operations and can expose secrets, alter repository state, or trigger network/package-manager activity without the metadata clearly disclosing those behaviors.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The workflow example expands the skill's apparent behavior from Git worktree management into automatic copying of .env files and propagation of environment-sensitive data. That creates a real security concern because .env files commonly contain secrets, and normalizing their automatic duplication into additional worktree directories increases the chance of accidental disclosure, misuse, or committing sensitive files.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This example again advertises automatic .env copying during worktree creation, which exceeds the stated scope of isolated Git worktree management and implicitly encourages secret replication across multiple directories. Repetition in workflow guidance makes the behavior appear standard and safe, increasing the likelihood that users will duplicate sensitive configuration without evaluating exposure risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Describing automatic .env file copying without any warning omits critical security context around sensitive credentials, tokens, and service configuration typically stored in those files. In a developer workflow skill, this is more dangerous because users are likely to trust the documented automation and may unknowingly spread secrets into extra worktree paths that have different permissions, backup behavior, or commit risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The help text documents automatic copying of .env files into worktrees but gives no warning that these files commonly contain secrets such as API keys, tokens, and database credentials. In a multi-worktree workflow this increases the chance of credential sprawl, accidental inclusion in backups or tooling output, and weaker control over where sensitive material is replicated.

Credential Access

High

• Category: Privilege Escalation

Content

fi
}

# Copy .env files from main repo to worktree
copy_env_files() {
  local worktree_path="$1"

• Confidence: 96% confidence
• Finding: The script intentionally enumerates and copies .env* files from the repository root into each worktree, which is direct handling and duplication of likely credential material. This creates additional at-rest copies of secrets and expands the number of filesystem locations, tools, and users that may access them.

Credential Access

High

• Category: Privilege Escalation

Content

done

  if [[ ${#env_files[@]} -eq 0 ]]; then
    echo -e "  ${YELLOW}ℹ️  No .env files found in main repository${NC}"
    return
  fi

• Confidence: 95% confidence
• Finding: This logic confirms the script's operational behavior around .env discovery and copying, reinforcing that secret-bearing files are treated as normal artifacts for replication. In an agent skill context, automatic propagation of credentials into new workspaces materially raises exposure risk through logs, archive operations, IDE indexing, or accidental commits of backups.

Credential Access

High

• Category: Privilege Escalation

Content

(from-branch defaults to main)
  list | ls                           List all worktrees
  switch | go [name]                  Switch to worktree
  copy-env | env [name]               Copy .env files from main repo to worktree
                                      (if name omitted, uses current worktree)
  cleanup | clean                     Clean up inactive worktrees
  help                                Show this help message

• Confidence: 89% confidence
• Finding: The help text advertises the copy-env capability without warning that it moves potentially sensitive credentials from the main repo into another workspace. Clear documentation of secret-handling side effects is important because users may invoke the feature without realizing it increases credential footprint.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.