repository-foundation-scaffold
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides structured guidelines and decision matrices for setting up standard repository files (README, LICENSE, CI/CD workflows, etc.) without introducing malicious logic.
- [COMMAND_EXECUTION]: Recommends the use of standard development tools, linters, and test runners (e.g., pnpm, vitest, biome) which is expected for repository scaffolding.
- [EXTERNAL_DOWNLOADS]: Mentions downloading and installing well-known developer tools and packages from the official Node.js ecosystem and Microsoft's TypeScript preview scope (@typescript/native-preview).
- [INDIRECT_PROMPT_INJECTION]: While the skill involves creating files that dictate AI agent behavior (like AGENTS.md), it includes explicit negative constraints forbidding the inclusion of instruction overrides or malicious patterns in these generated files.
- [DATA_EXFILTRATION]: Explicitly instructs the agent to ensure no data exfiltration requests are included in generated scripts or CI configurations.
Audit Metadata