scaffold-project
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a comprehensive scaffolding tool that follows established security best practices for AI agent development.
- [PROMPT_INJECTION]: No malicious prompt injection or override patterns were found in the instructions or templates. The skill proactively addresses security by providing a
PromptInjectionGuardclass and enforcing its use on all entry points of the generated code. - [REMOTE_CODE_EXECUTION]: Project generation is performed via the
quarkus_createtool, which is an authorized MCP tool for this environment. External libraries referenced in the Maven templates are standard, trusted artifacts from the Quarkus and LangChain4j ecosystems. - [DATA_EXFILTRATION]: The skill does not access sensitive local files or perform unauthorized network operations. Configuration templates use clear placeholders for user-specific settings and avoid hardcoding any secrets.
- [COMMAND_EXECUTION]: Interaction with the operating system and project files is mediated through official MCP tools like
quarkus_createandquarkus_skills, ensuring that all operations are scoped and observable.
Audit Metadata