vignette-catalog-scaffold
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/scaffold.pyutility usessubprocess.runto execute localgitcommands for repository discovery (git rev-parse) and initialization (git init). These calls use argument lists rather than shell strings, preventing common injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill's documentation and generated templates (
AGENTS.md.template) contain instructions to install additional agent skills vianpx skills. These references target the vendor's own repository (carpenter-singh-lab/vignette-catalog-skills) and established community tools (marimo-team/marimo-pair), representing standard project initialization behavior. - [DYNAMIC_EXECUTION]: The scaffolding script validates generated Python notebooks using
ast.parsebefore writing them to the disk. This ensures that the generated content is syntactically valid Python code, acting as a quality and safety check during the creation process.
Audit Metadata