scaffold-exercises

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local commands such as mkdir, git mv, and git commit to manage the project's directory structure and version history.
  • [COMMAND_EXECUTION]: It utilizes a project-specific tool via pnpm ai-hero-cli internal lint to validate the created structure against internal rules.
  • [PROMPT_INJECTION]: The skill processes user-supplied 'plans' to generate directory names. While this is an indirect injection surface, the instructions specifically direct the agent to use dash-case (lowercase, hyphens) naming conventions, which serves as a natural constraint against malicious shell metacharacters.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 10:38 PM
Security Audit — agent-trust-hub — scaffold-exercises