starter-dashboard
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed to automate the setup of a local development environment for Alpaca's trading and market data APIs. All analyzed scripts and instructions are consistent with this stated purpose.
- [SAFE]: API credentials (APCA_API_KEY_ID and APCA_API_SECRET_KEY) are managed using standard local development practices. The skill populates a local
.env.localfile from the user's environment or command-line flags. The instructions include specific safeguards to ensure these secrets are not displayed in the chat interface or command logs. - [COMMAND_EXECUTION]: Project initialization is handled by
scripts/scaffold.ts. This script implements defensive programming by validating input paths, preventing the overwriting of existing files, and refusing to operate on symbolic links to ensure the integrity of the user's file system. - [EXTERNAL_DOWNLOADS]: The generated project's dependencies consist of the vendor's official SDK (@alpacahq/alpaca-ts-alpha) and widely recognized libraries such as Next.js, React, and Zod, all sourced from the public npm registry.
Audit Metadata