npm-worktree
“Create a worktree for a branch. Places the worktree in the `<repo>.worktrees/` directory and initiates the npm install and other worktree copy overs.”
scripts
aipkg.jsonREADME.mdscripts/worktree.jsSKILL.md- 01PE3Credential Access70%HIGH
SKILL.md:107
detailhide
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| ------------ | ------------------------- | -------------------------------- | | `.env` | copied | | | `.env.dev` | copied | | | `.npmrc` | copied | private registry auth | | node_modules | `npm install` | exited cleanly | | `.claude/` | `npx @aipkgs/cli install` | rebuilt from `aipkg.json` | | `data/` | skipped | 2.3 GB — copy manually if needed |fix Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- 02PE3Credential Access60%HIGH
scripts/worktree.js:58
detailhide
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const currentWorktree = git(["rev-parse", "--show-toplevel"]); let envCount = 0; for (const entry of readdirSync(currentWorktree, { withFileTypes: true })) { if (!entry.isFile() || !entry.name.startsWith(".env")) continue; copyFileSync(join(currentWorktree, entry.name), join(worktreePath, entry.name)); envCount++; console.log(` Copied ${entry.name}`);fix Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- 03PE3Credential Access60%HIGH
scripts/worktree.js:67
detailhide
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
console.log(`Installing dependencies in ${worktreePath}...`); execFileSync("npm", ["install", "--prefix", worktreePath], { stdio: "inherit" }); console.log(`Done! Copied ${envCount} .env file(s) to ${worktreePath}`);fix Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.