electron-scaffold
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes official npm initialization commands, such as
npm init electron-app@latestandnpm create @quick-start/electron, to download project templates and development tools from the public npm registry. - [COMMAND_EXECUTION]: Includes a shell script (
scripts/scaffold.sh) designed to automate the creation of the project environment, including directory structuring, dependency installation via npm, and local git initialization. - [INDIRECT_PROMPT_INJECTION]: The scaffolding workflow prompts the user for project metadata (application name, description, and author) which is then interpolated into project configuration files and source code templates.
- Ingestion points: Interactive user prompts within
scripts/scaffold.shfor app name, description, and author fields. - Boundary markers: None; inputs are directly interpolated into the generated source code and configuration files.
- Capability inventory: File system write operations (
cat), dependency management (npm install), and version control commands (git init). - Sanitization: The script performs basic normalization but lacks formal sanitization for the interpolated metadata strings.
Audit Metadata