using-git-worktrees — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-git-worktrees (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ensure work happens in an isolated workspace. Prefer native harness tools. Fall back to git worktrees only when no native tool is available.
Core principle: Detect isolation first. Use native tools. Then fall back to git. Never fight the harness.
Announce: "Using using-git-worktrees to set up an isolated workspace."
Read docs/superskills/.skill-init before creating anything:
cat docs/superskills/.skill-init 2>/dev/null || echo "skill-init not run — run it first"Check TASK_TOOL field. If TASK_TOOL: NO → subagent dispatch won't work in this harness. Check HARNESS field — affects which native worktree tool to try in Step 1a.
GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
BRANCH=$(git branch --show-current)Submodule guard:
git rev-parse --show-superproject-working-tree 2>/dev/null
# If this returns a path → you're in a submodule, treat as normal repoIf `GIT_DIR != GIT_COMMON` (and not submodule): Already in linked worktree → skip to Step 3.
Report:
<path> on branch <name>."If `GIT_DIR == GIT_COMMON`: Normal repo. Ask consent before creating worktree:
"Would you like me to set up an isolated worktree? It protects your current branch."
Honor any existing preference without asking again. If user declines → skip to Step 3.
Check for: EnterWorktree, WorktreeCreate, /worktree, --worktree. If available → use it. Skip to Step 3.
Using git worktree add when a native tool exists creates phantom state. Don't.
Directory selection (priority order):
.worktrees/ exists at project root → use it (verify ignored)worktrees/ exists → use it (verify ignored)~/.config/superskills/worktrees/<project>/ exists → use it.worktrees/Safety verification (project-local only):
git check-ignore -q .worktrees 2>/dev/null || echo "NOT IGNORED"If NOT ignored → add to .gitignore, commit, then proceed.
Create:
project=$(basename "$(git rev-parse --show-toplevel)")
git worktree add "$path" -b "$BRANCH_NAME"
cd "$path"Sandbox fallback: If git worktree add fails with permission error → tell user, work in current directory instead, continue to Step 3.
[ -f package.json ] && npm install
[ -f Cargo.toml ] && cargo build
[ -f requirements.txt ] && pip install -r requirements.txt
[ -f pyproject.toml ] && poetry install
[ -f go.mod ] && go mod downloadnpm test / cargo test / pytest / go test ./...Tests fail: Report failures. Ask whether to proceed or investigate first. Tests pass: Report ready.
Worktree ready at <full-path>
Tests: N passing, 0 failures
Baseline: CLEAN
Ready to implement <feature-name>adr-commit replaces finishing-a-development-branchWhen work is complete, do NOT invoke `finishing-a-development-branch`. Instead invoke adr-commit — it includes the ADR Gate and PATTERN-DEBT lifecycle check before presenting merge options, then handles worktree cleanup identically.
| Situation | Action |
|---|---|
| Already in linked worktree | Skip to Step 3 |
| In submodule | Treat as normal repo |
| Native tool available | Use it (Step 1a) |
| No native tool | Git fallback (Step 1b) |
.worktrees/ exists | Use it (verify ignored) |
worktrees/ exists | Use it (verify ignored) |
| Neither exists | Default .worktrees/ |
| Directory not ignored | Add to .gitignore + commit |
| Permission error | Sandbox fallback, work in place |
| Tests fail at baseline | Report + ask before proceeding |
| Finishing feature | Use adr-commit, NOT finishing-a-development-branch |
git worktree add when native tool existsfinishing-a-development-branch at the end — use adr-commitgit worktree remove from inside the worktree<!-- Populated by knowledge-compound skill after cycles where this skill underperformed --> <!-- Format: [YYYY-MM-DD] What failed | Root cause | What to do instead --> <!-- DO NOT pre-populate with speculation — real observations only --> <!-- Example: [2026-06-01] Agent skipped risk scoring for "trivial" CSS task that touched auth config | Triage gate not read carefully | Triage gate now checks file content, not just task description -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.