quickstart

Pass

Audited by Gen Agent Trust Hub on Apr 26, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute npm and npx commands to initialize the project, install dependencies, and run developer tools. This is standard behavior for a project bootstrapping skill.
  • [EXTERNAL_DOWNLOADS]: The skill installs several Node.js packages from the npm registry, including the well-known vite package and vendor-specific packages such as @evenrealities/even_hub_sdk, @evenrealities/evenhub-cli, and @evenrealities/evenhub-simulator. These packages are part of the author's official ecosystem.
  • [PROMPT_INJECTION]: The skill includes instructions to process user-provided $ARGUMENTS to determine the project name. It explicitly directs the agent to sanitize this input by stripping spaces and special characters, which serves as a mitigation against potential command injection when the name is used in shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 26, 2026, 09:55 PM
Security Audit — agent-trust-hub — quickstart