scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard shell and git commands (
mkdir,git mv,git commit) and a project-specific linter (pnpm ai-hero-cli internal lint). These are expected operations for the stated purpose of scaffolding and validating directory structures. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided "plans" to generate directory and file names.
- Ingestion points: User-provided exercise plan in the conversation context (SKILL.md).
- Boundary markers: None explicitly defined for the input data, though naming conventions (dash-case) are specified.
- Capability inventory:
mkdir,git, andpnpm(subprocess execution) are used throughout the workflow. - Sanitization: The skill provides specific naming conventions (dash-case, lowercase, hyphens) which, if followed, mitigate command injection risks.
Audit Metadata