using-git-worktrees
Verdict safe, but 6 findings (2 medium, 4 low), mainly data exfiltration, resource abuse, policy violation. Most recent scan 2026-02-08.
The using-git-worktrees skill is generally well-designed for creating isolated git worktrees with safety verification. The core security posture is MODERATE with no critical threats detected. Primary concerns are: (1) command injection risk from unsanitized branch names, (2) unbounded resource consumption from automatic dependency installation and test execution without user confirmation or timeouts, and (3) missing metadata transparency. The skill correctly implements safety verification for .gitignore and follows systematic directory selection. No data exfiltration, credential theft, or prompt injection detected. The skill operates entirely locally with standard git operations. Recommended improvements: sanitize branch name input, add user confirmation for resource-intensive operations, and declare allowed-tools explicitly.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification
- Package
- 1 file, 5.5 KB
- SKILL.md
- 751 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Using Git Worktrees · Overview · Directory Selection Process · 1. Check Existing Directories · Check in priority order · 2. Check CLAUDE.md · 3. Ask User · Safety Verification · For Project-Local Directories (.worktrees or worktrees) · Check if directory is ignored (respects local, global, and system gitignore) · For Global Directory (~/.config/superpowers/worktrees) · Creation Steps
Findings
MEDIUM Command Injection Risk in Branch Name Variable Command Injectionllm
The skill uses $BRANCH_NAME variable directly in shell commands without validation or sanitization. If the branch name contains shell metacharacters (semicolons, backticks, command substitution syntax), it could lead to command injection when passed to 'git worktree add' or path construction. Example: a branch name like 'feature; rm -rf /' would execute unintended commands.
SKILL.md
git worktree add "$path" -b "$BRANCH_NAME" - The $BRANCH_NAME variable is used directly without sanitization. Path construction also uses unsanitized input: path="$LOCATION/$BRANCH_NAME"MEDIUM Unbounded Dependency Installation Without User Confirmation Resource Abusellm
The skill automatically runs package installation commands (npm install, pip install, cargo build, etc.) without user confirmation or resource limits. This could lead to excessive resource consumption, long-running operations, or installation of large dependency trees that exhaust disk space or network bandwidth. No timeout or size limits are specified.
SKILL.md
if [ -f package.json ]; then npm install; fi
if [ -f Cargo.toml ]; then cargo build; fi
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
if [ -f pyproject.toml ]; then poetry install; fi
if [ -f go.mod ]; then go mod download; fiLOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Missing allowed-tools Declaration Data Exfiltrationllm
The SKILL.md manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, declaring it would improve transparency about which agent tools (Bash, Read, Write, etc.) this skill requires. The instructions clearly involve Bash execution, file reading (CLAUDE.md, .gitignore), and file writing (.gitignore modifications).
SKILL.md:1
YAML frontmatter missing 'allowed-tools' field. Instructions reference: bash commands (ls, grep, git), file reading (CLAUDE.md, .gitignore), file writing (adding to .gitignore).LOW Unbounded Test Execution Without Timeout Resource Abusellm
The skill runs project test suites automatically without timeout limits or resource constraints. Test suites could contain infinite loops, hang indefinitely, or consume excessive resources. While the skill asks whether to proceed if tests fail, there's no protection against tests that never complete.
SKILL.md
npm test
cargo test
pytest
go test ./...
No timeout or resource limits specified for test execution.LOW Missing License and Compatibility Metadata Data Exfiltrationllm
The skill manifest does not specify 'license' or 'compatibility' fields. While optional, these fields help users understand usage rights and which environments (Claude.ai, Claude Code, API) the skill is designed for. This is informational only and does not indicate a security threat.
SKILL.md:1
YAML frontmatter shows:
- license: Not specified
- compatibility: Not specifiedWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 5.5 KB |
Package contents recorded 2026-10-22 at commit 06b92f36820f. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/obra/superpowers
- Raw scan result: using-git-worktrees-scan.json
- Badge for your README:
- Request a re-scan