pw-init

Pass

Audited by Gen Agent Trust Hub on Jun 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to automate project setup, including directory creation (mkdir), file deletion for cleanup (rm), and template extraction using awk.
  • [EXTERNAL_DOWNLOADS]: The skill installs the Playwright framework and the dotenv utility from the official NPM registry using npm init and npm install.
  • [SAFE]: The skill explicitly instructs the agent to update the project's .gitignore file to include sensitive directories and files, such as playwright-utils/.auth/ (storing session states) and .env.test.* (storing environment credentials).
  • [SAFE]: The skill reads from specific paths in the user's home directory (~/.claude/skills/) to copy project-specific architectural rules. This is a documented feature for propagating settings within the Claude Code environment and does not involve exfiltration of private user data.
  • [SAFE]: Requirement gathering utilizes the AskUserQuestion tool to ensure human-in-the-loop confirmation for configuration choices, preventing autonomous misconfiguration.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 29, 2026, 11:30 PM
Security Audit — agent-trust-hub — pw-init