scaffold
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several bundled shell scripts (
preflight.sh,overlay_templates.sh,verify_scaffold.sh) to manage the project setup lifecycle. These scripts use standard utilities likesed,jq, andfindfor file manipulation and environment verification. - [COMMAND_EXECUTION]: Instructs the agent to run framework initialization CLIs such as
pnpm create next-app@latestandpnpm create astro@latest. These are standard industry tools for project creation. - [EXTERNAL_DOWNLOADS]: The workflow involves installing various development dependencies from well-known registries (npm) via
pnpm, including@opennextjs/cloudflare,drizzle-orm, and@biomejs/biome. These are standard packages for the requested stack. - [EXTERNAL_DOWNLOADS]: Mentions a platform-scoped tool named
cffor Cloudflare management. While not a standard part of thewranglerCLI, the skill suggests the user install it viapnpmrather than downloading from an unverified remote source. - [SAFE_PRACTICE]: The skill includes a robust
.gitignoretemplate that explicitly masks sensitive files such as.env,.dev.vars, and credential JSON files, preventing accidental exposure of secrets in the bootstrapped project. - [SAFE_PRACTICE]: Documentation within
cloudflare-tooling.mdexplicitly instructs the agent never to attempt authentication on the user's behalf, directing the user to perform interactive login commands instead.
Audit Metadata