scaffold-exercises

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes common shell commands such as mkdir -p, echo, and git mv to generate and manage directory structures. It also invokes pnpm ai-hero-cli internal lint to validate the created content, which is consistent with the skill's stated purpose of scaffolding educational exercises.
  • [EXTERNAL_DOWNLOADS]: The skill references pnpm ai-hero-cli, which involves the Node.js package manager interacting with external registries to run the specified linter tool.
  • [PROMPT_INJECTION]: The workflow describes parsing user requirements to determine section and exercise names. This establishes an indirect prompt injection surface where the agent must process external data to generate shell commands. This is identified as a low-risk surface common to scaffolding tools, requiring the agent to maintain proper boundaries when handling user-provided strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 01:51 PM
Security Audit — agent-trust-hub — scaffold-exercises