npm-worktree
“Create a worktree for a branch. Places the worktree in the `<repo>.worktrees/` directory and initiates the npm install and other worktree copy overs.”
scripts
aipkg.jsonREADME.mdscripts/worktreeSKILL.md- 01PE3Credential Access70%HIGH
SKILL.md:109
detailhide
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
|--------------|-------------------|--------------------------------| | `.env` | copied | | | `.env.dev` | copied | | | `.npmrc` | copied | private registry auth | | node_modules | `npm install` | exited cleanly | | `.claude/` | `npx @aipkgs/cli install` | rebuilt from `aipkg.json` | | `data/` | skipped | 2.3 GB — copy manually if needed |fix Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- 02PE3Credential Access60%HIGH
scripts/worktree:41
detailhide
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
fi # Copy .env files from the current working tree to the new worktree CURRENT_WORKTREE="$(git rev-parse --show-toplevel)" ENV_COUNT=0 for env_file in "$CURRENT_WORKTREE"/.env*; dofix Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- 03PE3Credential Access60%HIGH
scripts/worktree:54
detailhide
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
echo "Installing dependencies in $WORKTREE_PATH..." npm install --prefix "$WORKTREE_PATH" echo "Done! Copied $ENV_COUNT .env file(s) to $WORKTREE_PATH"fix Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.