ClawHub
Back to skill

Security audit

using-git-worktrees

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed git-worktree helper, but users should notice that it may also update .gitignore, create a commit, and run project setup or tests.

Install this if you want agents to isolate git work in worktrees. Before use, be aware it may make a .gitignore commit and run dependency installation or tests, so review those actions if you want tighter control over repository history or local environment changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest describes this skill as being used when the user wants git work isolation via a separate worktree so the main working tree is not disturbed. However, the body instructs the agent to perform broader project setup actions such as `npm install`, `cargo build`, `pip install`, `poetry install`, `go mod download`, and baseline test execution, which go beyond creating or selecting an isolated worktree.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest frames the skill as isolating work in a separate git worktree. The instructions add a separate repository-modifying behavior: if the worktree directory is not ignored, the agent should edit `.gitignore` and commit that change. Creating a commit in the repository is a materially broader action than merely setting up isolated workspace usage.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The manifest description is written as an instruction in Indonesian ('Gunakan saat user minta...') and the surrounding policy sections are also mandated in Indonesian, but the file does not offer any language choice or explain a justified locale restriction. This is a natural-language locale policy issue because it imposes a specific language context without user opt-in.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation rule says only 'Aktif ketika user meminta hal yang cocok dengan deskripsi di atas' with a negative trigger of 'di luar scope deskripsi,' which does not provide specific trigger phrases, boundaries, or negative examples. This makes invocation dependent on broad interpretation and could cause unintended activation for loosely related requests about Git or isolation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
> "Would you like me to set up an isolated worktree? It protects your current branch from changes."

Honor any existing declared preference without asking. If the user declines consent, work in place and skip to Step 2.

## Step 1: Create Isolated Workspace
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.