tauri-scaffold

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill defines template structures that incorporate external user-supplied data into the agent's context.
  • Ingestion points: The file templates/basic.md contains placeholders for {project_name}, {frontend_framework}, {dev_url}, and {dist_path} which are intended to be populated with user-provided strings.
  • Boundary markers: The templates do not utilize specific delimiters or instructions to prevent the agent from misinterpreting data within these variables as new commands or instruction overrides.
  • Capability inventory: The skill is designed to guide project structure and suggest shell commands such as create-tauri-app as specified in SKILL.md.
  • Sanitization: The skill does not provide mechanisms for escaping or validating these project-specific variables before they are interpolated.
  • [COMMAND_EXECUTION]: The skill facilitates the generation and suggested execution of project initialization tools.
  • Evidence: SKILL.md explicitly instructs the agent to "Use create-tauri-app with appropriate options."
  • Analysis: This is the primary intended function of the skill and aligns with standard developer workflows, though it relies on the agent correctly handling user-provided parameters.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 06:49 PM