scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands including
mkdir -pfor directory creation,git mvfor renaming, andgit commitfor version control operations. These are standard operations for project scaffolding tasks. - [EXTERNAL_DOWNLOADS]: The skill references
pnpm ai-hero-cli internal lint, which implies a dependency on a CLI tool. In the context of the skill's purpose and the vendor, this appears to be a legitimate internal utility used for validating exercise structure. - [INDIRECT_PROMPT_INJECTION]: The skill processes exercise plans to extract directory names. While this presents an ingestion surface for untrusted data, the instructions explicitly mandate a 'dash-case' naming convention (lowercase, hyphens), which serves as a natural sanitization step for the AI when executing file system commands.
Audit Metadata