Worktrunk

• Analyzed: May 2, 2026, 6:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2ee9bf4df365e6e28d1776d7d5fe270a4024b806a683d0194580ad0702fc75a4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle describes a Git worktree management tool that includes high-risk capabilities, specifically arbitrary command execution via the `-x` flag and automated shell hooks defined in `.worktrunk/hooks.toml`. While these features are aligned with the stated purpose of automating parallel development workflows, they provide a direct path for command injection or unauthorized execution if the agent processes untrusted input. No evidence of intentional malice, such as data exfiltration or backdoors, was found in SKILL.md or _meta.json.