scaffold-dashboard
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell script (
scaffold.sh) and a TypeScript generator (create-resource.ts) that execute system commands. scaffold.shrunsbun installto set up project dependencies after copying the template files.create-resource.tsusesexecSyncto runbunx biomefor code formatting.- These operations are standard for development scaffolding tools and the generator script includes strict regex validation (
/^[a-z][a-z0-9]*$/) on user-provided resource names to prevent command injection. - [EXTERNAL_DOWNLOADS]: The
scaffold.shscript initiates abun installcommand, which downloads project dependencies from official package registries. This is expected behavior for a project initialization skill. - [CREDENTIALS_SAFE]: The project template correctly avoids hardcoding secrets. It uses environment variable placeholders in
.env.exampleand implements logic to fail securely in production if necessary secrets (likeBETTER_AUTH_SECRET) are missing. Development fallbacks are explicitly labeled as insecure and intended for local use only.
Audit Metadata