跳到主要内容
知仓学习社ZHICANG

git-worktree-manager

>

读凭据执行命令读文件写文件严重 26 · 高危 3borghei/Claude-Skills

它会碰到什么

扫了多少7 个文本文件,63 KB
它会碰到什么读凭据执行命令读文件写文件
命中总数34 处
命中统计严重 26 · 高 3 · 中 5 · 低 0
逐条看命中(29 条严重或高危)
  • 严重 references/cleanup-and-workflows.md:107cred-paths
    3. `.env` files are present and contain worktree-specific ports
  • 严重 references/operations-playbook.md:12cred-paths
    - **Not updating .env ports after worktree creation** — the setup script should handle this automatically
  • 严重 references/operations-playbook.md:30cred-paths
    | `.env` file missing after worktree creation | Setup script was not run or `.env` does not exist in the main repo | Copy `.env` manually from the main repo roo
  • 严重 references/operations-playbook.md:30cred-paths
    | `.env` file missing after worktree creation | Setup script was not run or `.env` does not exist in the main repo | Copy `.env` manually from the main repo roo
  • 严重 references/operations-playbook.md:30cred-paths
    | `.env` file missing after worktree creation | Setup script was not run or `.env` does not exist in the main repo | Copy `.env` manually from the main repo roo
  • 严重 references/operations-playbook.md:32cred-paths
    | Dependencies fail to install in new worktree | Lockfile references a private registry or cache not available in the worktree path | Ensure `.npmrc`, `.yarnrc.
  • 严重 references/operations-playbook.md:32cred-paths
    | Dependencies fail to install in new worktree | Lockfile references a private registry or cache not available in the worktree path | Ensure `.npmrc`, `.yarnrc.
  • 严重 references/operations-playbook.md:34cred-paths
    | Worktree shows as dirty immediately after creation | Untracked files from `.env` copy or generated `.worktree-ports.json` | Add `.worktree-ports.json` and cop
  • 严重 references/operations-playbook.md:40cred-paths
    - **100% env parity** between main repo and worktrees verified by diffing `.env` keys (values may differ for ports)
  • 严重 references/setup-and-ports.md:124cred-paths
    for envfile in .env .env.local .env.development; do
  • 严重 references/setup-and-ports.md:124cred-paths
    for envfile in .env .env.local .env.development; do
  • 严重 references/setup-and-ports.md:124cred-paths
    for envfile in .env .env.local .env.development; do
  • 严重 references/setup-and-ports.md:151cred-paths
    # 4. Update .env with allocated ports
  • 严重 references/setup-and-ports.md:152cred-paths
    if [ -f "$WT_PATH/.env" ]; then
  • 严重 references/setup-and-ports.md:155cred-paths
    sed -i.bak "s/APP_PORT=.*/APP_PORT=$APP_PORT/" "$WT_PATH/.env"
  • 严重 references/setup-and-ports.md:156cred-paths
    sed -i.bak "s/:5432/:$DB_PORT/g" "$WT_PATH/.env"
  • 严重 references/setup-and-ports.md:157cred-paths
    rm -f "$WT_PATH/.env.bak"
  • 严重 references/setup-and-ports.md:158cred-paths
    echo "Updated .env with worktree ports"
  • 严重 scripts/worktree_validator.py:30cred-paths
    ENV_FILES = [".env", ".env.local", ".env.development", ".env.test"]
  • 严重 scripts/worktree_validator.py:30cred-paths
    ENV_FILES = [".env", ".env.local", ".env.development", ".env.test"]
  • 严重 scripts/worktree_validator.py:30cred-paths
    ENV_FILES = [".env", ".env.local", ".env.development", ".env.test"]
  • 严重 scripts/worktree_validator.py:30cred-paths
    ENV_FILES = [".env", ".env.local", ".env.development", ".env.test"]
  • 严重 scripts/worktree_validator.py:217cred-paths
    "message": "No .env files found in main repo. Skipping parity check.",
  • 严重 SKILL.md:23cred-paths
    - **Worktree lifecycle** — create worktrees from new or existing branches with deterministic naming, copy `.env` files, install dependencies by lockfile detecti
  • 严重 SKILL.md:80cred-paths
    | `env-secrets-manager` | Worktree setup copies `.env` files that contain secrets managed by this skill | `.env` files flow from main repo to each worktree; sec
  • 严重 SKILL.md:80cred-paths
    | `env-secrets-manager` | Worktree setup copies `.env` files that contain secrets managed by this skill | `.env` files flow from main repo to each worktree; sec
  • scripts/port_allocator.py:39exec-spawn
    result = subprocess.run(
  • scripts/worktree_manager.py:31exec-spawn
    result = subprocess.run(
  • scripts/worktree_validator.py:40exec-spawn
    result = subprocess.run(

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Git Worktree Manager

Manage parallel development workflows using Git worktrees with deterministic naming, automatic port allocation, environment file synchronization, dependency installation, and cleanup automation. Optimized for multi-agent workflows where each agent or terminal session owns an isolated worktree with its own ports, environment, and running services.

Core Capabilities

  • Worktree lifecycle — create worktrees from new or existing branches with deterministic naming, copy .env files, install dependencies by lockfile detection, list with clean/dirty + ahead/behind status, and safely remove with uncommitted-change detection.
  • Port allocation — deterministic per-worktree assignment (base + index * stride), collision detection against running processes, persistent map in .worktree-ports.json, and Docker Compose override generation.
  • Multi-agent isolation — one branch per worktree, one agent per worktree, no shared state, conflict-free parallel execution, task-ID mapping for traceability.
  • Cleanup automation — stale detection by age, merged-branch detection for safe removal, dirty-state warnings, and bulk cleanup with safety confirmations.

When to Use

  • You need 2+ concurrent branches open with running dev servers.
  • You want isolated environments for feature work, hotfixes, and PR review.
  • Multiple AI agents need separate workspaces that do not interfere.
  • Your current branch is blocked but a hotfix is urgent.
  • You want automated cleanup instead of manual rm -rf operations.

Clarify First

Before managing worktrees, confirm these inputs. If any is unknown or vague, ASK — do not assume:

  • [ ] Operation — create, list, remove, or clean up worktrees (selects the worktree_manager.py action vs port_allocator.py vs worktree_validator.py)
  • [ ] Branch & base — which branch(es) the worktree(s) track and from what base (drives worktree naming and isolation)
  • [ ] Port/service needs — whether dev servers or Docker need allocated ports (drives the deterministic port block and the Docker Compose override generated)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools

| Tool | Purpose | Command |

|------|---------|---------|

| worktree_manager.py | List, create, remove, and clean up worktrees | python scripts/worktree_manager.py list |

| port_allocator.py | Assign/check/release deterministic port blocks; sync registry | python scripts/port_allocator.py status |

| worktree_validator.py | Validate worktree health (stale, missing branch, env parity, port conflicts, lockfile) | python scripts/worktree_validator.py --stale-days 14 |

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

  • [references/setup-and-ports.md](references/setup-and-ports.md) — quick-start git worktree commands, the deterministic port-allocation strategy and .worktree-ports.json format, collision-detection snippet, the full setup-worktree.sh script, and the Docker Compose per-worktree override. Read when creating a worktree or wiring up ports/services.
  • [references/cleanup-and-workflows.md](references/cleanup-and-workflows.md) — the cleanup-worktrees.sh safe-cleanup script, the multi-agent assignment pattern and rules, the scenario→action decision matrix, and the post-creation validation checklist. Read when automating cleanup or coordinating agents.
  • [references/operations-playbook.md](references/operations-playbook.md) — common pitfalls, best practices, the troubleshooting table, and the success-criteria bar. Read before shipping a workflow or when diagnosing problems.

Scope & Limitations

This skill covers:

  • Git worktree lifecycle: creation, listing, status inspection, and removal
  • Deterministic port allocation and collision avoidance for parallel dev servers
  • Environment file synchronization and Docker Compose override patterns
  • Multi-agent workspace isolation strategies and cleanup automation

This skill does NOT cover:

  • Git branching strategies or merge conflict resolution (see pr-review-expert and release-manager)
  • Secret rotation, vault integration, or credential management (see env-secrets-manager)
  • CI/CD pipeline configuration or automated test orchestration (see ci-cd-pipeline-builder)
  • Monorepo package management, workspace linking, or cross-package dependency resolution (see monorepo-navigator)

Integration Points

| Skill | Integration | Data Flow |

|-------|-------------|-----------|

| env-secrets-manager | Worktree setup copies .env files that contain secrets managed by this skill | .env files flow from main repo to each worktree; secret references remain consistent across all copies |

| ci-cd-pipeline-builder | CI pipelines can spin up worktrees for parallel test matrix execution | Pipeline config triggers setup-worktree.sh per matrix job; port allocation prevents service collisions |

| release-manager | Release branches get dedicated worktrees for stabilization while feature work continues | Release worktree is created from the release branch; merged status drives cleanup automation |

| monorepo-navigator | In monorepo setups, worktrees must respect package boundaries and shared dependencies | Worktree creation inherits the monorepo root lockfile; package-level dev servers use allocated port blocks |

| pr-review-expert | PR reviews can be performed in isolated worktrees with running code for manual validation | Reviewer creates a worktree at the PR branch, runs the dev server on allocated ports, and removes after review |

| tech-debt-tracker | Stale worktrees and abandoned branches surface as tech debt indicators | Cleanup script output feeds into debt tracking; worktree age and merge status inform priority scores |

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。