init-monorepo
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several local shell commands to initialize the project environment. This includes
git initfor version control,pnpm initandpnpm installfor package management, andpnpm exec lefthook installto set up git hooks. - [COMMAND_EXECUTION]: It uses a shell command (
bash -lc 'source "$NVM_DIR/nvm.sh" && nvm version-remote --lts') to dynamically resolve the current Node.js LTS version for use in configuration files. - [EXTERNAL_DOWNLOADS]: The skill fetches development dependencies from the NPM registry and references GitHub Actions from official and well-known sources, including
pnpm/action-setup,actions/setup-node, andactions/checkout. - [REMOTE_CODE_EXECUTION]: The
pnpm dlxcommand is used to download and execute utility packages likeskills,add-gitignore, andaudit-ci. These are standard tools for scaffolding and security maintenance. - [SAFE]: The skill installs additional agent utilities from the same author (
humanpluslabsoss/skills), representing legitimate vendor functionality for extending the development environment.
Audit Metadata