ClawHub
Back to skill

Security audit

Git Worktree Ops

Security checks across malware telemetry and agentic risk

Overview

This is a small Git worktree helper guide; the main caution is that its remove command can delete local worktrees and the referenced helper script is not included in the package.

Before installing or using this skill, verify the local tools/git_worktree_manager.sh script because it was not included in the reviewed package. Use the remove command only after confirming the target worktree and checking for uncommitted or needed files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly documents a destructive removal command for worktrees but provides no warning, confirmation guidance, or note about possible data loss. In an agent-facing automation skill, terse operational docs can be executed mechanically, so missing safety context increases the chance of accidental deletion of active workspaces or uncommitted work.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.