bootstrap-astro
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install several official and well-known packages using
bun,npm, andgem. This includes the Astro framework, React, Tailwind CSS, and the Kamal deployment tool. - [COMMAND_EXECUTION]: The skill uses shell commands to initialize the project directory (
bun create astro), manage dependencies (bun add,npm install), and facilitate deployment (kamal setup,kamal deploy). These operations are standard for a developer scaffolding tool. - [CREDENTIALS_UNSAFE]: The generated configuration files include placeholders for sensitive data, such as
GITHUB_TOKENin.env.exampleand a reference to the user's local SSH key path (~/.ssh/id_rsa) inconfig/deploy.yml. These are standard configuration patterns for deployment tools and do not involve the skill accessing or exfiltrating existing secrets.
Audit Metadata