using-git-worktrees — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-git-worktrees (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- Adapted from obra/superpowers — tessera scan step added after setup -->
Ensure work happens in an isolated workspace. Prefer your platform's native worktree tools. Fall back to manual git worktrees only when no native tool is available.
Announce at start: "I'm using the using-git-worktrees skill to set up an isolated workspace."
Before creating anything, check if you are already in an isolated workspace:
GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)Submodule guard: verify you are not in a submodule before concluding "already in a worktree":
git rev-parse --show-superproject-working-tree 2>/dev/nullGIT_DIR != GIT_COMMON (and not a submodule): already in a linked worktree. Skip to Step 3.GIT_DIR == GIT_COMMON: normal repo. Ask for consent before creating a worktree.Try in order:
1a. Native worktree tool (preferred): If a tool like EnterWorktree, WorktreeCreate, or /worktree command is available, use it and skip to Step 3. Never fight the harness.
1b. Git worktree fallback (only if no native tool):
Directory priority:
.worktrees/ or worktrees/ at project root~/.config/superpowers/worktrees/<project>/.worktrees/ at project rootSafety check for project-local directories:
git check-ignore -q .worktrees 2>/dev/null || git check-ignore -q worktrees 2>/dev/nullIf NOT ignored: add to .gitignore, commit, then proceed.
git worktree add "$path" -b "$BRANCH_NAME"
cd "$path"if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
if [ -f pyproject.toml ]; then uv sync; fi
if [ -f package.json ]; then npm install; fiIf tessera MCP is configured in this session: run tessera scan . after setup.
tessera scan .This registers the new worktree's files in Tessera's graph so graph_continue can route reads correctly in the new workspace.
# Python: uv run pytest
# Node: npm test
# Go: go test ./...If tests fail: report failures, ask whether to proceed or investigate.
Report:
Worktree ready at <full-path>
Tests passing (<N> tests, 0 failures)
Ready to implement <feature-name>| Situation | Action |
|---|---|
| Already in linked worktree | Skip creation (Step 0) |
| Native worktree tool available | Use it (Step 1a) |
| No native tool | Git worktree fallback (Step 1b) |
| Directory not ignored | Add to .gitignore + commit |
| Tests fail during baseline | Report failures + ask |
Never:
git worktree add when a native worktree tool is availabletessera scan when tessera is active (graph becomes stale)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.