Trust Assessment
using-git-worktrees received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Automatic Execution of Untrusted Setup and Test Commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on August 1, 2026 (commit 44c9b2d6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Automatic Execution of Untrusted Setup and Test Commands The skill instructs the agent to automatically run package installation and test commands (such as `npm install`, `cargo build`, `pip install`, and `npm test`) without user confirmation. When the agent is used on untrusted repositories, this behavior allows arbitrary code execution via malicious dependency lifecycle scripts, build scripts, or test suites. Modify the skill instructions to explicitly require user consent before running any setup, installation, or test commands (e.g., 'Ask the user for permission before running installation or test commands, as they can execute arbitrary code'). | LLM | SKILL.md:81 |
Scan History
Embed Code
[](https://skillshield.io/report/31cccc31f61115f0)
Powered by SkillShield