scaffold-exercises

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands including mkdir -p for directory creation, git mv for renaming, and git commit for version control operations. These are standard operations for project scaffolding tasks.
  • [EXTERNAL_DOWNLOADS]: The skill references pnpm ai-hero-cli internal lint, which implies a dependency on a CLI tool. In the context of the skill's purpose and the vendor, this appears to be a legitimate internal utility used for validating exercise structure.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes exercise plans to extract directory names. While this presents an ingestion surface for untrusted data, the instructions explicitly mandate a 'dash-case' naming convention (lowercase, hyphens), which serves as a natural sanitization step for the AI when executing file system commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 10:27 AM
Security Audit — agent-trust-hub — scaffold-exercises