Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

ia-git-worktree

v3.0.4

Manage Git worktrees for isolated parallel development. Use when creating, listing, switching, or cleaning up git worktrees, or when needing isolated branche...

0· 242·0 current·0 all-time
byIlia Alshanetsky@iliaal

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for iliaal/compound-eng-git-worktree.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "ia-git-worktree" (iliaal/compound-eng-git-worktree) from ClawHub.
Skill page: https://clawhub.ai/iliaal/compound-eng-git-worktree
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install compound-eng-git-worktree

ClawHub CLI

Package manager switcher

npx clawhub@latest install compound-eng-git-worktree
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with a git-worktree manager. However SKILL.md documents extra behaviors (automatic dependency installation, hook installation/handling, environment detection logic) that are not implemented in the included script. The script implements core worktree creation, listing, switching, copying .env files, and cleanup — which is coherent — but the README over-promises additional automation.
!
Instruction Scope
SKILL.md instructs agents to always call the manager script and describes actions beyond the script (installing dependencies, running tests, hook logic, CODEX_SANDBOX detection). The script does copy local .env* files (except .env.example) into worktrees and appends .worktrees to .gitignore, and performs git checkout/pull which modifies repo state. Copying .env files exposes local secrets within additional directories (no network exfiltration present, but still sensitive). The mismatch between instructions and actual script behavior is problematic for automation.
Install Mechanism
No install spec (instruction-only) and only a single bundled script. Nothing is downloaded or written to disk by an installer here beyond what the script itself does when executed.
Credentials
The skill declares no required environment variables or credentials. SKILL.md references an env var (CODEX_SANDBOX) for context detection but the script does not use it. The main proportionality concern is that the script copies .env* files (which commonly contain secrets) from the repository into worktree directories — this is local file access rather than external exfiltration, but it increases the number of places secrets live on disk and may be undesirable.
Persistence & Privilege
always is false and the skill does not request persistent platform-level privileges. It does modify repo files (.gitignore) and runs git commands that change local repo state, but it does not alter other skills or system-wide agent settings.
What to consider before installing
This skill appears intended to manage git worktrees, but the SKILL.md promises extra automation (dependency installs, hook management, sandbox detection) that the provided script doesn't implement — a sign of mismatch or stale docs. Before installing or invoking: 1) review and validate scripts locally (they will run git checkout/pull and modify .gitignore); 2) be aware the script copies all .env* files (except .env.example) into worktrees — this duplicates any secrets on disk and may be undesirable; 3) back up .gitignore and test in a disposable clone to observe behavior (especially interactive prompts and network git pulls); 4) if you expect automatic dependency installation or hook handling, request an updated script or reject until implemented. The issues look like sloppy/incomplete packaging rather than intentional malice, but confirm behavior in a safe environment first.

Like a lobster shell, security has layers — review code before you run it.

latestvk971h88wpvq66ee8wggyh4j9kx85nnne
242downloads
0stars
11versions
Updated 14h ago
v3.0.4
MIT-0

Git worktree manager

Always use the manager script

Never call git worktree add directly -- always use the worktree-manager.sh script.

The script handles critical setup that raw git commands don't:

  1. Copies .env, .env.local, .env.test, etc. from main repo
  2. Ensures .worktrees is in .gitignore
  3. Creates consistent directory structure
  4. After creation, install dependencies if detected: package.jsonnpm install, composer.jsoncomposer install, pyproject.tomlpip install -e ., go.modgo mod download

Safety Verification

Before creating a worktree, verify the worktree directory is gitignored:

# Verify .worktrees is ignored (should output ".worktrees")
git check-ignore .worktrees || echo "WARNING: .worktrees not in .gitignore"

If not ignored, add it to .gitignore before proceeding. The manager script handles this, but verify when troubleshooting.

After creating a worktree, run the project's test suite to establish a clean baseline. Pre-existing failures in the worktree should be caught before starting new work -- not discovered mid-implementation.

# CORRECT - Always use the script
bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh create feature-name

# WRONG - Never do this directly
git worktree add .worktrees/feature-name -b feature-name main

Commands

CommandDescriptionExample
create <branch> [from]Create worktree + branch (default: from main)...worktree-manager.sh create feature-login
list / lsList all worktrees with status...worktree-manager.sh list
switch <name> / goSwitch to existing worktree...worktree-manager.sh switch feature-login
copy-env <name>Copy .env files to existing worktree...worktree-manager.sh copy-env feature-login
cleanup / cleanInteractively remove inactive worktrees...worktree-manager.sh cleanup

After cleanup, run git worktree prune to remove any orphaned worktree metadata from manually deleted directories.

All commands use: bash ${CLAUDE_PLUGIN_ROOT}/skills/ia-git-worktree/scripts/worktree-manager.sh <command>

Environment Detection

Before creating worktrees, detect the execution context:

  1. Already in a worktree? Check git rev-parse --show-toplevel against git worktree list. If the current directory is already a linked worktree, skip creation -- work directly in the existing worktree.
  2. Codex/sandbox environment? If $CODEX_SANDBOX is set or the repo is at a non-standard path (e.g., /tmp/, /workspace/), worktrees may not be supported. Fall back to regular branch switching.
  3. Bare repo? If git rev-parse --is-bare-repository returns true, worktrees are the only way to have a working directory. Adjust paths accordingly.

Adapt the workflow to the detected context rather than failing with a generic error.

Integration with Workflows

/ia-review

  1. Check current branch
  2. If ALREADY on target branch -> stay there, no worktree needed
  3. If DIFFERENT branch -> offer worktree: "Use worktree for isolated review? (y/n)"

/ia-work

Always offer choice:

  1. New branch on current worktree (live work)
  2. Worktree (parallel work)

Branch Completion

When work in a worktree is done, verify tests pass, then present exactly 4 options:

  1. Merge locally -- merge into base branch, delete worktree branch, clean up worktree
  2. Push + PR -- push branch, create PR with gh pr create, keep worktree until merged
  3. Keep as-is -- leave branch and worktree for later
  4. Discard -- requires typing "discard" to confirm. Deletes branch and worktree. No silent discards.

Clean up the worktree directory only for options 1 and 4. For option 2, the worktree stays until the PR merges.

Change Summary

When completing work in a worktree (before merge or PR), output a structured summary:

CHANGES MADE:
- src/routes/tasks.ts: Added validation middleware

THINGS I DIDN'T TOUCH (intentionally):
- src/routes/auth.ts: Has similar validation gap but out of scope

POTENTIAL CONCERNS:
- The Zod schema is strict -- rejects extra fields. Confirm this is desired.

The "DIDN'T TOUCH" section prevents reviewers from wondering whether adjacent issues were missed or intentionally deferred.

Hook Safety Under Husky

Installing hooks into .git/hooks/ silently fails on any repo that uses Husky. Husky sets core.hooksPath (typically to .husky/_) and git ignores .git/hooks/ entirely when that config is non-empty. The hook file lands on disk, is executable, is correct, and is dead. Invisible failure until someone asks why the post-merge behavior isn't running.

Detection rule before writing any hook

hooks_path=$(git -C "$repo" config --get core.hooksPath)
  • Empty output: write to $(git rev-parse --git-common-dir)/hooks/<name> as usual.
  • .husky/_ (or any path containing husky.sh / h trampoline): Husky v9 setup. Write to .husky/<name>; do NOT include the v8-era . "$(dirname "$0")/_/husky.sh" line (v9 prints a deprecation warning if you do).
  • Unrecognized non-empty value: refuse to write the hook and surface the path to the user. Silent writes to the wrong location waste debug cycles later.

Worktree-safe hook body

.git/hooks/ lives in the common git dir and runs for every worktree of the clone. A hook installed once fires across all trees. Two rules to stay safe:

  1. Resolve the invoking worktree's root inside the hook body with git rev-parse --show-toplevel, not a hardcoded path. Hardcoding means the last install-hooks invocation wins for every worktree.
  2. Guard the tool invocation with an existence check on the tool's per-tree state dir. Siblings without your tool's setup must no-op, not spawn a failing background process per git op.
#!/bin/sh
root="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
[ -d "$root/.my-tool" ] || exit 0
( cd "$root" && my-tool index ) >>"$root/.my-tool/hook.log" 2>&1 &
exit 0

Redirect to a log file inside the tool's state dir, not /dev/null — silent failures produce stale state you only notice hours later.

Local Excludes: .git/info/exclude vs .gitignore

Tooling artifacts (local index dirs, hook helpers, per-developer scratch files) belong in .git/info/exclude, NOT in the tracked .gitignore.

  • .gitignore is content — tracked, shared with the team, reviewed in PRs. Adding a personal tooling rule there pollutes a shared file. On foreign repos (upstream projects, third-party clones) the rule either rides into a PR by accident or sits as a dirty working tree forever.
  • .git/info/exclude is local — untracked, lives in the common git dir, shared across every worktree of the clone. Same syntax and semantics as .gitignore without the leakage.

Resolving the path correctly under worktrees

Don't hardcode $repo/.git/info/exclude. In a worktree, .git is a file (gitlink), not a directory. Use git itself:

exclude=$(git -C "$repo" rev-parse --git-path info/exclude)

Idempotent append

line="/.my-tool/"
mkdir -p "$(dirname "$exclude")"
grep -qxF "$line" "$exclude" 2>/dev/null || printf '\n# my-tool\n%s\n' "$line" >> "$exclude"

grep -qxF matches the exact line with no regex surprises.

When to break the rule

Only when the artifact is genuinely team-shared and belongs in the repo (build outputs used in CI, generated files, vendored dependencies). If in doubt, ask: "would another contributor benefit from this rule?" If no, exclude locally.

Verify

  • git worktree list shows the new entry
  • .worktrees directory confirmed in .gitignore
  • Dependencies installed in the worktree
  • Baseline test suite passes in the worktree

References

Comments

Loading comments...