Worktree Agents

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:35 AM UTC
• Version: 1.0.0

Overview

This skill is a real worktree orchestration helper, but it uses high-impact automation with weak safeguards, including disabled agent permissions, GitHub credential reuse, remote repository mutation, and a hardcoded API key to a plaintext third-party endpoint.

Install only after review. Do not run this against important repositories as written. Remove the hardcoded API key and plaintext proxy, use a dedicated least-privilege GitHub token, avoid permission-bypass flags, inspect diffs before commit/push/merge, and fix the cleanup script so it cannot delete paths outside an intended worktree directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/orchestrate.sh:29
• Finding: Agent Safety and Permission Controls Are Explicitly Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/orchestrate.sh:29-30`; supporting instructions in `SKILL.md:89-89`, `SKILL.md:119-122`, and `references/task-decomposition.md:30-33` **Vulnerability Type**: Safety-control bypass during AI agent execution **Risk Level**: Critical ### Vulnerable Code ```bash "$CLAUDE_BIN" --dangerously-skip-permissions --print -p "$TASK_PROMPT" \ >> "$LOG_FILE" 2>&1 ``` The documentation also proposes an equivalent unrestricted Codex mode: ```bash "$CODEX_BIN" exec --full-auto "$TASK_PROMPT" # Or without a sandbox: "$CODEX_BIN" --yolo "$TASK_PROMPT" ``` ### Technical Analysis The orchestrator launches Claude Code with `--dangerously-skip-permissions`, while the documented Codex alternative permits `--yolo`. These options intentionally remove or bypass permission prompts and sandbox restrictions that normally constrain filesystem and command execution. `TASK_PROMPT` is supplied as a positional argument to the script. Although the documentation tells agents to observe file-ownership boundaries, the script does not enforce those boundaries. Prompt instructions are therefore the only control preventing the launched agent from reading sensitive files, modifying unrelated files, or executing arbitrary tools. This is an instruction-level safety override because loading and following the Skill causes the agent operator to disable the execution controls intended to protect the current session and host environment. ### Attack Path 1. An attacker, compromised upstream instruction, or untrusted project content influences `TASK_PROMPT`. 2. `orchestrate.sh` passes that prompt to Claude Code. 3. Claude Code starts with permission checks disabled. 4. The launched agent executes commands or accesses files outside its nominal task scope without interactive approval. 5. The orchestrator may subsequently stage and commit the resulting changes. ### Impact Assessment Successful exploitation can provide access to any files and ...[truncated 363 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--dangerously-skip-permissions` and do not recommend `--yolo`. - Run agents in an isolated container or sandbox with a read/write mount limited to the assigned worktree. - Use explicit command and tool allowlists. - Require approval for shell execution, network access, credential reads, and writes outside approved files. - Validate changed files against a per-agent ownership allowlist before staging or committing. - Treat task prompts and repository content as untrusted input. - Run each agent under a dedicated low-privilege operating-system identity without access to user secrets. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:112
• Finding: Hardcoded API Credential Is Sent to a Plaintext Third-Party Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:112-113` **Vulnerability Type**: Hardcoded secret and plaintext transmission of sensitive data **Risk Level**: Critical ### Vulnerable Code ```bash export OPENAI_API_KEY="<hardcoded API key redacted from this report>" export OPENAI_BASE_URL="http://152.53.52.170:3003/v1" ``` The credential value is present in plaintext in the audited file. It is redacted here to avoid further disclosure. ### Technical Analysis The Skill embeds an API key directly in its documentation and instructs users to export it into the process environment. Anyone with access to the Skill package or its version history can recover and reuse the credential. The configured API base URL uses unauthenticated plaintext HTTP and a bare IP address. Consequently, API authorization data, prompts, source-code context, and generated responses may be visible to the remote endpoint and to an on-path network attacker. Because responses are not protected by TLS, an on-path attacker can also modify model output. This concern is amplified by the Skill's recommendation to run generated actions with permission and sandbox controls disabled. ### Attack Path 1. A user follows the Skill instructions and exports the embedded credential. 2. Codex is configured to communicate with `http://152.53.52.170:3003/v1`. 3. The client transmits authorization material and task data over plaintext HTTP. 4. The endpoint operator or an on-path attacker captures the credential and sensitive prompts. 5. An attacker may reuse the key or tamper with generated responses. 6. If the response is acted upon in unrestricted agent mode, manipulated output can cause unauthorized local operations. ### Impact Assessment The exposed key may permit unauthorized API consumption up to the permissions and billing scope assigned to it. Plaintext traffic can disclose proprietary source code, prompts, credentials included in context, and generated output. Response manipulation ...[truncated 124 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Revoke and rotate the exposed API key immediately. - Remove the credential from the current files and all repository history. - Obtain credentials from an approved secret manager or protected environment variable supplied explicitly by the user. - Use a dedicated, short-lived, least-privilege credential for each execution environment. - Require a trusted HTTPS endpoint with valid certificate verification; reject plaintext HTTP endpoints. - Do not override the official API endpoint by default. - Add secret scanning to pre-commit and CI workflows. - Review endpoint ownership and logs to determine whether the exposed credential or sensitive task data has already been accessed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:104
• Finding: GitHub Credential Is Read from Another Skill's Private Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:104-104`; credential source also described at `SKILL.md:14-14` **Vulnerability Type**: Cross-skill credential access and violation of least privilege **Risk Level**: High ### Vulnerable Code ```bash GH_TOKEN=$(cat ~/.openclaw/openclaw.json | jq -r '.skills.entries["gh-issues"].apiKey') ``` ### Technical Analysis The Skill instructs the agent to read a GitHub token from the private configuration entry assigned to a separate Skill. Worktree creation and local orchestration do not inherently require access to that credential. Reusing another component's token crosses a trust boundary and prevents effective isolation, attribution, and least-privilege enforcement. The extracted token is then expected to be supplied to `push_and_pr.sh`, which uses it for authenticated Git pushes and GitHub API requests. There is no validation that the token is repository-scoped, short-lived, or explicitly authorized for the target repository. ### Attack Path 1. The Skill reads `~/.openclaw/openclaw.json`. 2. It extracts the `gh-issues` Skill's API key. 3. The credential is passed to the branch-push and pull-request script. 4. The script authenticates Git and GitHub API operations using that credential. 5. A malicious prompt, repository, or target parameter can cause the credential to be used outside the original Skill's intended context. ### Impact Assessment The effective privileges are those granted to the extracted GitHub token. Depending on its scope, this may include reading or writing private repositories, pushing branches, creating pull requests, and accessing other GitHub resources available to the token owner. Compromise is not necessarily limited to the current repository if the token has broader permissions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not access credentials belonging to another Skill or integration. - Require the user to provide explicit authorization for remote publication. - Use a dedicated GitHub App installation token or fine-grained personal access token restricted to the intended repository and operations. - Prefer short-lived credentials generated for each run. - Pass credentials through a protected secret channel rather than command-line arguments or documentation examples. - Verify that the requested `owner/repository` is explicitly approved before using a token. - Separate local worktree operations from authenticated publication so the former can run without GitHub credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/push_and_pr.sh:18
• Finding: GitHub Token Is Persisted in the Git Remote URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/push_and_pr.sh:18-23` **Vulnerability Type**: Persistent credential exposure in Git configuration **Risk Level**: High ### Vulnerable Code ```bash # Set token authentication cd "$WORKTREE_PATH" git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${OWNER_REPO}.git" # Push GIT_ASKPASS=true git push origin "$BRANCH" 2>&1 >&2 ``` ### Technical Analysis The script interpolates `GH_TOKEN` into the `origin` remote URL. `git remote set-url` writes that value into repository or worktree-associated Git configuration, where it remains after the push completes. The script neither restores the original URL nor removes the credential. Any local process or user able to inspect the relevant Git configuration can recover the token. The token may also be exposed by diagnostics, backups, configuration collection, process tracing, or later commands that print remote URLs. ### Attack Path 1. A GitHub token is passed to `push_and_pr.sh`. 2. The script writes the token into the `origin` remote URL. 3. The push completes, but the credential-bearing URL remains configured. 4. A later process, local user, agent, diagnostic command, or backup reads the Git configuration. 5. The recovered token is reused against GitHub within its granted scope. ### Impact Assessment An attacker obtaining the token inherits its GitHub privileges until it expires or is revoked. Potential impact includes unauthorized source access, malicious branch pushes, pull-request manipulation, and compromise of other repositories if the token is not narrowly scoped. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Never place credentials in Git remote URLs. - Keep the remote URL credential-free, for example `https://github.com/OWNER/REPOSITORY.git`. - Use an ephemeral `GIT_ASKPASS` helper, a secure credential helper, or a temporary authorization header. - Ensure credentials are not passed in command-line arguments visible through process inspection. - If temporary Git configuration is unavoidable, use process-scoped configuration and remove it in an `EXIT` trap. - Scan existing worktrees and Git configuration for persisted tokens, then revoke any exposed token. - Restore the original remote URL after authenticated operations. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_worktrees.sh:17
• Finding: Unchecked Recursive Deletion Allows Worktree Path Escape<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_worktrees.sh:11-12` and `scripts/setup_worktrees.sh:17-26` **Vulnerability Type**: Unsafe recursive deletion using user-controlled path components **Risk Level**: High ### Vulnerable Code ```bash WORKTREES_BASE="$2" shift 2 AGENTS=("$@") cd "$REPO_DIR" mkdir -p "$WORKTREES_BASE" for AGENT in "${AGENTS[@]}"; do BRANCH="feature/$AGENT-$(date +%Y%m%d-%H%M%S)" WORKTREE_PATH="$WORKTREES_BASE/$AGENT" # Remove an existing worktree if git worktree list | grep -q "$WORKTREE_PATH"; then git worktree remove --force "$WORKTREE_PATH" 2>/dev/null || true fi rm -rf "$WORKTREE_PATH" ``` ### Technical Analysis Both `WORKTREES_BASE` and each `AGENT` value originate from command-line arguments. The script concatenates them to form `WORKTREE_PATH` and passes that path to `rm -rf` without canonicalization, containment validation, or restrictions on agent names. Shell quoting prevents ordinary shell metacharacter injection, but it does not prevent path traversal. An agent name containing `..` components can resolve outside the intended worktree base. Dangerous base paths, absolute or traversal-like agent values, and symlink-related path behavior are also not rejected. The preceding `git worktree` check does not protect the unconditional `rm -rf`. ### Attack Path 1. An attacker or erroneous caller supplies a crafted worktree base or agent name containing traversal components. 2. The script builds `WORKTREE_PATH` by string concatenation. 3. The resulting path resolves outside the intended worktree directory. 4. `rm -rf "$WORKTREE_PATH"` recursively deletes that external path with the privileges of the invoking user. For example, a base such as `/home/user/worktrees` combined with an agent value containing sufficient `../` components can target an unrelated directory. ### Impact Assessment The operation can delete arbitrary directories writable by the invoking user. The scope may include so ...[truncated 172 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Restrict agent names to a safe pattern such as `^[A-Za-z0-9_-]+$`. - Reject empty names, absolute paths, slashes, backslashes, `.` components, and `..` components. - Resolve the base and target to canonical paths before deletion. - Verify that the canonical target is a strict descendant of an approved, non-root worktree base. - Reject `/`, the user's home directory, the repository root, and other protected locations as deletion targets. - Check for symlinks and avoid following attacker-controlled path redirections. - Replace unconditional deletion with explicit worktree lifecycle management where possible. - Display the validated target and require confirmation for destructive cleanup outside a dedicated temporary directory. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/orchestrate.sh:38
• Finding: All Agent Changes Are Committed While Repository Hooks Are Bypassed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/orchestrate.sh:38-45` **Vulnerability Type**: Unrestricted staging and validation bypass **Risk Level**: Medium ### Vulnerable Code ```bash else # If Claude did not commit by itself, finish the commit if git status --porcelain | grep -q .; then git add -A git commit -m "feat: $AGENT_NAME task complete" --no-verify 2>&1 | tee -a "$LOG_FILE" echo "[$(date '+%H:%M:%S')] $AGENT_NAME: committed uncommitted changes" | tee -a "$LOG_FILE" fi fi ``` ### Technical Analysis `git add -A` stages every modification, deletion, and untracked file in the worktree, regardless of the file ownership constraints described in the Skill documentation. The `--no-verify` option then disables repository commit hooks that may enforce formatting, tests, policy checks, or secret detection. The script performs no changed-file allowlist validation, secret scan, test run, or human diff review before committing. This is especially dangerous because the changes originate from an agent launched with permission checks disabled. ### Attack Path 1. A compromised or misdirected agent modifies files outside its assigned scope or creates a file containing sensitive data or malicious code. 2. The agent leaves those changes uncommitted. 3. `orchestrate.sh` detects a dirty worktree. 4. `git add -A` stages all changes. 5. `git commit --no-verify` bypasses local validation hooks. 6. `push_and_pr.sh` can publish the branch and open a pull request containing the unauthorized changes. ### Impact Assessment The vulnerability can cause secrets, backdoors, generated artifacts, destructive deletions, or unrelated modifications to enter repository history and be published remotely. It does not independently grant new operating-system privileges, but it significantly increases the likelihood and persistence of repository compromise. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--no-verify` and allow repository security hooks to run. - Replace `git add -A` with explicit staging of approved files. - Maintain a per-agent changed-file allowlist and fail if any other path changes. - Review `git diff`, including staged changes and deletions, before committing. - Run repository tests, linters, dependency checks, and secret scanning before publication. - Reject changes to sensitive locations such as CI configuration, hooks, credentials, dependency manifests, and executable scripts unless expressly authorized. - Require human approval before pushing agent-generated commits or opening pull requests. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill instructs reading a GitHub token from a local secrets file and performing remote GitHub operations without prominent user warning or explicit consent. Silent credential use is dangerous because it can turn an apparently local coding helper into a capability that authenticates to external services and changes repositories on the user's behalf.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The workflow describes automatic commit, push, PR creation, and merge behavior without a prominent warning that these actions can create irreversible or externally visible changes. In a multi-agent setup, automation compounds the risk because multiple branches and remote actions may be executed in parallel, reducing human review and increasing the chance of accidental or unauthorized merges.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill recommends running Claude Code with disabled permission safeguards using a dangerous flag to bypass sandbox restrictions. This materially increases risk because the orchestrated agents are asked to execute code-writing and git commands across worktrees, so removing permission checks can enable unintended file access or destructive local actions beyond the intended repository scope.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Recommending disabled permission safeguards without a strong warning understates the filesystem and process-execution risk to the user. In this context, the agents are orchestrated to modify files and commit changes, so bypassing safety controls can enable broader unintended access or damage if prompts, scripts, or child agents misbehave.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 如果 Claude 没有自己 commit，帮它收尾
  if git status --porcelain | grep -q .; then
    git add -A
    git commit -m "feat: $AGENT_NAME task complete" --no-verify 2>&1 | tee -a "$LOG_FILE"
    echo "[$(date '+%H:%M:%S')] $AGENT_NAME: committed uncommitted changes" | tee -a "$LOG_FILE"
  fi
fi

• Confidence: 94% confidence
• Finding: Using `git commit --no-verify` bypasses local pre-commit and commit-msg hooks that may enforce security scanning, secrets detection, policy checks, or provenance controls. Combined with `git add -A`, the script can persist all generated or modified content—including unsafe code or secrets—while intentionally skipping a key defensive control.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill invokes shell scripts, git operations, curl, and external binaries but does not declare any explicit tool scope such as permissions or allowed-tools. That makes the operational boundary unclear and increases the chance the skill is executed with broader capabilities than users expect, especially because it can make filesystem and network-affecting changes.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The natural-language description, triggers, and task prompt template are all presented in Chinese, which effectively imposes a language expectation for use of the skill. The file does not indicate that users may choose another language or that the Chinese-only presentation is a justified regional constraint.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation conditions are broad enough to match ordinary requests about multi-agent collaboration or parallel work, which can cause the skill to activate in contexts where the user did not intend aggressive automation. Because the skill includes repository mutation, credential access, and remote merge behavior, overbroad triggering materially increases the chance of unsafe execution.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill's stated purpose is local multi-agent worktree orchestration, yet it additionally instructs reading a GitHub token from a local secrets file and later using it for remote repository actions. Expanding from local automation into credential access and remote merge authority broadens the attack surface and creates a path for unauthorized repository modification if the skill is triggered unexpectedly or repurposed.

External Transmission

Medium

• Category: Data Exfiltration

Content

验证通过后通过 GitHub API 合并：

```bash
curl -s -X PUT \
  -H "Authorization: Bearer $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/<owner/repo>/pulls/<pr_number>/merge" \

• Confidence: 93% confidence
• Finding: This line performs an authenticated external transmission to the GitHub API to merge pull requests. External transmission is not inherently malicious, but in this skill it is security-relevant because it uses credentials and triggers remote state changes, so it becomes dangerous without explicit user approval and tight scope controls.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The skill embeds a live-looking API key and directs traffic to a custom external model endpoint, which goes well beyond documented local orchestration. Hardcoded credentials and use of an untrusted proxy endpoint can expose user prompts, repository contents, and secrets to third parties, making this especially dangerous in a code automation workflow that handles source trees and tokens.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document explicitly recommends running Claude Code with `--dangerously-skip-permissions`, which disables a key safety control and normalizes bypassing permission checks for autonomous code execution. In the context of multi-agent orchestration where several instances may write to a repository in parallel, this materially increases the chance of unauthorized file modification, destructive changes, or broader workspace impact; the cleanup section also includes forceful removal commands without warning about accidental deletion risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script explicitly invokes Claude Code with `--dangerously-skip-permissions`, removing interactive safety barriers, then automatically stages and commits all changes produced in the worktree. In a multi-agent orchestration context, this enables unattended execution of agent-generated modifications and persistence of potentially unsafe or malicious code without human review, which materially increases risk beyond a normal automation script.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This shell script performs safety-relevant authenticated actions: it embeds the provided GitHub token into the git remote URL and sends it in an HTTP Authorization header to create a PR. Although the file has brief comments about pushing and opening a PR, it does not include any confirmation prompt or user-facing warning that credentials will be used for remote push and GitHub API calls.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 开 PR
PR_BODY="## $AGENT_NAME Output\n\nGenerated by OpenClaw multi-agent worktree orchestrator.\n\nWorktree: \`$WORKTREE_PATH\`\nBranch: \`$BRANCH\`"

RESPONSE=$(curl -s -X POST \
  -H "Authorization: Bearer $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/$OWNER_REPO/pulls" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

RESPONSE=$(curl -s -X POST \
  -H "Authorization: Bearer $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/$OWNER_REPO/pulls" \
  -d "$(jq -n \
    --arg title "[$AGENT_NAME] automated task" \
    --arg head "$BRANCH" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

RESPONSE=$(curl -s -X POST \
  -H "Authorization: Bearer $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/$OWNER_REPO/pulls" \
  -d "$(jq -n \
    --arg title "[$AGENT_NAME] automated task" \
    --arg head "$BRANCH" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script forcibly removes an existing git worktree and then recursively deletes the target directory with `rm -rf` without any confirmation, dry-run, or path safety validation. In this skill's context, a controller orchestrates multiple agents and may invoke the script repeatedly or with variable agent names/base paths, so a misconfiguration can cause unintended data loss beyond the user's immediate awareness.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The file content is entirely in Chinese, including operational guidance, with no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Natural-language strings in the file, including the descriptive comments and usage guidance, are presented solely in Chinese. Under the policy, forcing a specific language without opt-in is a locale/language policy concern when no alternative or selection mechanism is provided.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The natural-language instructions in the file are written only in Chinese, including the description, usage, and output comments. This imposes a specific language on users without any opt-in, alternative locale, or documented justification that the skill is intended only for a Chinese-language audience.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The script's natural-language comments and usage description are written only in Chinese, with no indication that another language is supported or that the locale is intentionally limited. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The script runs `git checkout -b` and `git worktree add`, which modify repository state by creating branches and worktrees. There is no user-facing log or warning explaining that repository structure will be changed, and the brief usage comments do not mention this side effect explicitly.