scaffold-project

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a comprehensive scaffolding tool that follows established security best practices for AI agent development.
  • [PROMPT_INJECTION]: No malicious prompt injection or override patterns were found in the instructions or templates. The skill proactively addresses security by providing a PromptInjectionGuard class and enforcing its use on all entry points of the generated code.
  • [REMOTE_CODE_EXECUTION]: Project generation is performed via the quarkus_create tool, which is an authorized MCP tool for this environment. External libraries referenced in the Maven templates are standard, trusted artifacts from the Quarkus and LangChain4j ecosystems.
  • [DATA_EXFILTRATION]: The skill does not access sensitive local files or perform unauthorized network operations. Configuration templates use clear placeholders for user-specific settings and avoid hardcoding any secrets.
  • [COMMAND_EXECUTION]: Interaction with the operating system and project files is mediated through official MCP tools like quarkus_create and quarkus_skills, ensuring that all operations are scoped and observable.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 05:34 PM