scaffold-mvp
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs standard project scaffolding tasks using official ecosystem tools including
dotnetCLI,npm, andAngular CLI. - [SAFE]: The instructions mandate the use of mature, established UI libraries such as MudBlazor, Radzen, Angular Material, and PrimeNG, reducing the risk associated with custom or obscure implementations.
- [SAFE]: Security best practices are enforced, such as pinning exact dependency versions and using
.env.exampletemplates for secret management. - [SAFE]: The skill references the author's official repository at
github.com/afonsoft/skillsfor its skill collection context. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local documentation and specification files to drive the scaffolding logic.
- Ingestion points: Phase 1 reads external content from
.claude/CONTEXT.mdand.specs/SPEC-*.md. - Boundary markers: No specific delimiters or "ignore instructions" markers are defined for the ingested files.
- Capability inventory: The skill has capabilities for file system writes, project solution generation, and package installation.
- Sanitization: The risk is mitigated by a mandatory Phase 2 validation step where the agent must obtain explicit user approval in Portuguese before executing any scaffolding commands.
Audit Metadata