scaffold-dashboard

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a shell script (scaffold.sh) and a TypeScript generator (create-resource.ts) that execute system commands.
  • scaffold.sh runs bun install to set up project dependencies after copying the template files.
  • create-resource.ts uses execSync to run bunx biome for code formatting.
  • These operations are standard for development scaffolding tools and the generator script includes strict regex validation (/^[a-z][a-z0-9]*$/) on user-provided resource names to prevent command injection.
  • [EXTERNAL_DOWNLOADS]: The scaffold.sh script initiates a bun install command, which downloads project dependencies from official package registries. This is expected behavior for a project initialization skill.
  • [CREDENTIALS_SAFE]: The project template correctly avoids hardcoding secrets. It uses environment variable placeholders in .env.example and implements logic to fail securely in production if necessary secrets (like BETTER_AUTH_SECRET) are missing. Development fallbacks are explicitly labeled as insecure and intended for local use only.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 12:40 PM
Security Audit — agent-trust-hub — scaffold-dashboard