scaffold
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill primarily consists of documentation and code templates for scaffolding new software projects. No malicious patterns such as prompt injection, data exfiltration, or obfuscation were detected.
- [COMMAND_EXECUTION]: The instructions include numerous example shell commands for project initialization (e.g.,
uv init,npx create-next-app,cargo init,go mod init). These are standard tools for the stated purpose of the skill and do not pose a risk in this context. - [EXTERNAL_DOWNLOADS]: The skill references several official scaffolding tools and GitHub Actions (e.g.,
create-next-appfrom Vercel,setup-uvfrom Astral-sh, and official GitHub actions). These originate from well-known technology companies and trusted open-source contributors. - [CREDENTIALS_UNSAFE]: Code templates include placeholder values for environment variables and secrets, such as
"change-me-in-production"or"user:pass@localhost". These are correctly identified as placeholders for the user to replace, following standard security best practices for project templates.
Audit Metadata