scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands such as
mkdir,git mv, andgit committo manage the project's directory structure and version history. - [COMMAND_EXECUTION]: It utilizes a project-specific tool via
pnpm ai-hero-cli internal lintto validate the created structure against internal rules. - [PROMPT_INJECTION]: The skill processes user-supplied 'plans' to generate directory names. While this is an indirect injection surface, the instructions specifically direct the agent to use dash-case (lowercase, hyphens) naming conventions, which serves as a natural constraint against malicious shell metacharacters.
Audit Metadata