using-git-worktrees — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-git-worktrees (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One repo, many checkouts — parallel branches without stashing or cloning.
A worktree is a second working directory backed by the same .git. Each tree has its own branch, index, and files, so agents never fight over one checkout.
✅ Good for:
git stash dance❌ Not for:
# Create a new tree + branch in one step (sibling dir, NOT nested in repo)
git worktree add ../proj-feature -b feature/login
# Attach an existing branch
git worktree add ../proj-hotfix hotfix/crash
# Detached checkout of a tag/commit for inspection
git worktree add --detach ../proj-v1 v1.2.0
# See every tree, its branch, and HEAD
git worktree list
# Remove a tree when done (must be clean, or add --force)
git worktree remove ../proj-feature
# Drop bookkeeping for trees deleted manually from disk
git worktree prune| Rule | Why |
|---|---|
Put trees as siblings (../proj-feature), never inside the repo | A nested tree gets swept into Git status and ignore rules |
| One branch per tree | Git refuses to check out the same branch twice; keeps ownership clear |
Name the dir after the branch (proj-<slug>) | git worktree list becomes self-documenting |
| One agent ↔ one tree | Isolates state; merge happens only at the end |
Branch off the same base (-b feat origin/main) | Predictable, conflict-light merges |
# 0. Start from an up-to-date main
git -C ./proj fetch origin
# 1. Spin up two isolated trees for two agents
git -C ./proj worktree add ../proj-api -b feat/api origin/main
git -C ./proj worktree add ../proj-ui -b feat/ui origin/main
# 2. Each tree installs its OWN deps (not shared — see pitfalls)
( cd ../proj-api && npm ci )
( cd ../proj-ui && npm ci )
# 3. Agents work in parallel, commit on their branches...
# 4. Merge back from the canonical tree
git -C ./proj merge --no-ff feat/api
git -C ./proj merge --no-ff feat/ui # resolve conflicts once, here
# 5. Tear down
git -C ./proj worktree remove ../proj-api
git -C ./proj worktree remove ../proj-ui
git -C ./proj worktree prune.git;run npm ci (or equivalent) in each tree. Reusing one folder breaks native binaries and lockfile assumptions.
git submodule update --init --recursiveafter worktree add.
--detach.git worktree prune.
each tree.
.git; removing itorphans every other worktree.
git worktree lock to preventauto-prune, unlock before removing.
git worktree remove <path> (or --force if dirty and discardable)git worktree prune to clear stale metadatagit branch -d <branch>git worktree list shows only trees you still needRemember: worktrees isolate files and branches, not dependencies. Treat each tree as a full checkout — install, configure, and clean it up on its own.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.