init-project

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell scripts (scripts/init-skeleton.sh and scripts/init-research-profile.sh) to generate the project skeleton and optional research profiles. These scripts use standard file system operations and do not perform network activities or access sensitive system paths.
  • [COMMAND_EXECUTION]: The skill configures a PostToolUse hook in .claude/settings.json that executes auto-format-python.sh. This hook uses ruff to automate code formatting and linting for Python files. The script safely parses environment-provided JSON input using an inline Python command.
  • [SAFE]: The skill implements a Phase 2 interactive workflow for filling out CLAUDE.md. While this involves reading project metadata (like package.json or README.md) which could contain untrusted data, the skill mitigates indirect prompt injection risks by requiring explicit user confirmation via AskUserQuestion before writing any generated content to disk.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 07:37 AM
Security Audit — agent-trust-hub — init-project