scaffold-route
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: Analysis of the skill instructions and code templates found no evidence of malicious patterns, such as command injection, data exfiltration, or unauthorized persistence.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user input for 'feature name' and 'CRUD operations' to dynamically generate file paths and code content.
- Ingestion points: User input prompted during skill execution (SKILL.md instructions).
- Boundary markers: Templates are delimited by Markdown code blocks, but no specific input validation/sanitization rules are defined for the feature name input.
- Capability inventory: The skill performs file system writes and updates existing project files (server/api/root.ts, validations/index.ts).
- Sanitization: No explicit sanitization of user input is specified; the skill relies on the agent following the provided singular, lowercase lowercase naming convention.
Audit Metadata