init-pipeline

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs legitimate project scaffolding tasks including creating local git hooks, configuring tool settings, and managing project-specific metadata in a local sidecar directory. All operations are confined to the project directory or the user's local application data folder (~/.claude).
  • [SAFE]: The included script 'scripts/sidecar.sh' is a utility for managing a private git repository used for project state tracking. It includes robust environment isolation (clearing GIT_DIR, etc.) to ensure git operations on the sidecar do not interfere with the main project.
  • [SAFE]: The skill uses standard developer tools (git, pnpm, tsc, vitest, biome) and follows best practices for secret management by recommending .env files for sensitive data, though it does not explicitly handle credentials itself.
  • [SAFE]: External references target the author's official GitHub repositories and are used for documentation purposes. No unexpected or obfuscated network requests were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 08:45 PM