scaffold-project
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access detected. The skill instructions align with legitimate project scaffolding workflows for the 'gcx' tool from the vendor.\n- [COMMAND_EXECUTION]: The skill utilizes the 'gcx' CLI tool for project scaffolding. These commands are localized to the project creation process and are standard for this type of developer tool.\n- [PROMPT_INJECTION]: The skill ingests user-supplied project names and Go module paths for interpolation into the 'gcx' command. 1. Ingestion point: user-provided parameters in SKILL.md. 2. Boundary markers: absent. 3. Capability inventory: shell command execution via 'gcx' in SKILL.md. 4. Sanitization: the documentation states that project names are automatically kebab-cased, which serves as a basic sanitization layer.
Audit Metadata