Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add greglas75/zuvo --skill worktreegit clone --depth 1 https://github.com/greglas75/zuvoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greglas75/zuvo/worktree)<a href="https://agentmods.dev/skills/greglas75/zuvo/worktree"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/worktree/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/greglas75/zuvo/worktree"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/worktree.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 383 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 53 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Rogue Agent · line 253 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 556 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.07303 |
| Opus 5.5 | $0.00024 | $0.02921 |
| Sonnet 5.5 | $0.00012 | $0.01461 |
| Haiku 4.5 | $0.00006 | $0.00730 |
Grade A, and why
worktree scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 564 lines — stays where its author put it; the contents beside it link to each section on GitHub.
zuvo:worktree
Git worktree isolation with structured completion options.
Three modes: CREATE (set up a new worktree), FINISH (wrap up work in the current worktree), and PRUNE (reclaim finished worktrees and fix a nested layout).
Detect mode automatically:
- If the user explicitly says "create", "finish", or "prune"/"cleanup", honor that regardless.
- If the current directory IS inside a worktree (check
git worktree list), default to FINISH. - If the current directory is the main checkout, default to CREATE.
CREATE Mode
Step 0: Accumulation Precheck
Run PRUNE steps 1-2 (bookkeeping reconcile + classification) in report-only form. Removing nothing, print one line:
Worktrees in this repo: <n> live (<n> reclaimable, <n> idle >30d). Layout: <sibling | NESTED>.
If reclaimable or nested worktrees exist, point at zuvo:worktree prune and continue with CREATE. Never block CREATE on cleanup.
Step 1: Determine Worktree Directory
Compute the default first -- it is a sibling of the repo, never a child:
REPO_ROOT=$(git rev-parse --show-toplevel)
REPO_NAME=$(basename "$REPO_ROOT")
DEFAULT_WTDIR="$(dirname "$REPO_ROOT")/${REPO_NAME}-worktrees"
Resolution order. Use the first match, do NOT ask the user:
$ZUVO_WORKTREE_DIRif set -- absolute path, or relative to$REPO_ROOT.- Project instructions preference -- a
worktree/worktreessection in the projectAGENTS.mdorCLAUDE.mdthat declares a directory. If the declared path is inside$REPO_ROOT, honor it but emit the nested-layout warning below. - Existing sibling --
$DEFAULT_WTDIRalready exists. - Existing nested directory (LEGACY) --
.worktrees/,worktrees/, or.claude/worktrees/inside$REPO_ROOT. Use it so worktrees for one repo do not end up split across two locations, but you MUST emit the nested-layout warning and offer the PRUNE-mode migration in the same turn. - Default --
$DEFAULT_WTDIR. Create it withmkdir -p.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 564 lines · 61 tokens per session scan A ad0f12e63af0
worktree is a skill published in the GitHub repository greglas75/zuvo (7 stars, last pushed yesterday), licensed MIT. It adds 61 tokens to every session and 7,303 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
changelog
Add CHANGELOG.md entries, derive them from commits, or cut a Keep a Changelog and SemVer release.
wrap-up-branch
Finish a feature branch: add missing tests, review and fix the code, align docs, then merge only after explicit confirmation.
resolve-merge
Resolve an active merge or rebase conflict, including safe renumbering of colliding plans and chronicles.
commit
Create a user-requested Conventional Commit from the staged changes.
kanso-pr
Use when the user asks to write a pull request description, open a PR, draft PR notes, or summarise a branch for review.
release
Cut a brooks-lint release: set the version in package.json, propagate it across all four plugin manifests and every version-bearing text file (README badges, docs site metadata), write the CHANGELOG entry, validate, then commit, push, tag, and publish the GitHub release. Triggers when the maintainer asks to "release"…