Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/bahayonghang/my-ai-cli-toolkitnpx agentmods add skills/bahayonghang/my-ai-cli-toolkit/super-worktreeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/super-worktree)<a href="https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/super-worktree"><img src="https://agentmods.dev/badge/skills/bahayonghang/my-ai-cli-toolkit/super-worktree/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/super-worktree"><img src="https://agentmods.dev/badge/skills/bahayonghang/my-ai-cli-toolkit/super-worktree.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02011 |
| Opus 5 | $0.00031 | $0.01006 |
| Sonnet 5 | $0.00012 | $0.00402 |
| Haiku 4.5 | $0.00006 | $0.00201 |
Grade D, and why
super-worktree scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| "jq not found" | `brew install jq` (macOS) / `sudo apt install jq` (Ubuntu) | Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
{ "sync": { "copyFiles": ["${HOME}/.aws/credentials"] } } How it starts
The opening of the file, as written. The whole thing — 237 lines — stays where its author put it; the contents beside it link to each section on GitHub.
super-worktree
Git worktree manager with env file copying and node_modules symlinking. Work on multiple branches at once without leaving your session.
What users can say (copy-paste prompts)
After installing, users can say things like these to their AI agent:
Create:
- "Create a worktree for feature/login"
- "Set up a worktree for hotfix from production"
- "Start work on TEST-1 with slug 'test feature'"
- "Spin up a worktree for PR 1234" (requires
gh) - "Spin up a worktree for MR 42" (requires
glab)
Manage:
- "List my worktrees / show me which ones are dirty"
- "Delete the payments worktree"
- "Re-sync env files into the login worktree"
- "Merge feature/login back into main and clean up"
- "Prune orphan worktrees"
- "Show me worktree status as JSON"
With AI tool integration:
- "Create a worktree and append
claudeto the cd hint" --tool opencodeor--tool codexalso work
How it works
bash scripts/worktree-manager.sh create <branch> [from-branch] [options]
- Creates a git worktree at
.worktrees/<branch>/ - Copies env files (
.env, credentials, etc.) from source - Symlinks
node_modules(saves disk space) - Runs lifecycle hooks (preCreate, postCreate, etc.)
- Prints a copy-pasteable
cdhint
Config schema (super-worktree.json)
Place in repo root. All fields optional.
{
"$schema": "./schemas/super-worktree.schema.json",
"version": 1,
"sync": {
"copyFiles": [
".env", ".env.*", ".envrc", ".local.*",
"*.secret", "*.key", ".secrets.*",
"credentials.json", "credentials.yml", "credentials.env",
"auth.json", "auth.yml", "auth.env",
".dev.vars", ".prod.vars", ".staging.vars"
],
"symlinkDirs": ["node_modules"],
"exclude": ["node_modules", ".git", "dist", "build", ".next",
"out", "coverage", ".turbo", ".vercel", ".worktrees"],
"copyDepth": 2
},
"hooks": {
"preCreate": "echo creating $BRANCH",
"postCreate": "pnpm install --frozen-lockfile",
"preDelete": "echo cleaning $BRANCH"
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 237 lines · 62 tokens per session scan D c8592a3f9a54
super-worktree is a skill published in the GitHub repository bahayonghang/my-ai-cli-toolkit (16 stars, last pushed 2d ago), licensed MIT. It adds 62 tokens to every session and 2,011 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
comet-github
A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
changelog-composer
Generates structured changelogs and release notes from git history and PRs, classifying breaking changes, features, fixes, performance, docs. Triggers on: "generate changelog", "write release notes", "what changed since", "prepare release", "release notes for", "diff since tag".
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…