scaffold

Pass

Audited by Gen Agent Trust Hub on Jul 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several bundled shell scripts (preflight.sh, overlay_templates.sh, verify_scaffold.sh) to manage the project setup lifecycle. These scripts use standard utilities like sed, jq, and find for file manipulation and environment verification.
  • [COMMAND_EXECUTION]: Instructs the agent to run framework initialization CLIs such as pnpm create next-app@latest and pnpm create astro@latest. These are standard industry tools for project creation.
  • [EXTERNAL_DOWNLOADS]: The workflow involves installing various development dependencies from well-known registries (npm) via pnpm, including @opennextjs/cloudflare, drizzle-orm, and @biomejs/biome. These are standard packages for the requested stack.
  • [EXTERNAL_DOWNLOADS]: Mentions a platform-scoped tool named cf for Cloudflare management. While not a standard part of the wrangler CLI, the skill suggests the user install it via pnpm rather than downloading from an unverified remote source.
  • [SAFE_PRACTICE]: The skill includes a robust .gitignore template that explicitly masks sensitive files such as .env, .dev.vars, and credential JSON files, preventing accidental exposure of secrets in the bootstrapped project.
  • [SAFE_PRACTICE]: Documentation within cloudflare-tooling.md explicitly instructs the agent never to attempt authentication on the user's behalf, directing the user to perform interactive login commands instead.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 4, 2026, 01:30 PM
Security Audit — agent-trust-hub — scaffold