init-project
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell scripts (
scripts/init-skeleton.shandscripts/init-research-profile.sh) to generate the project skeleton and optional research profiles. These scripts use standard file system operations and do not perform network activities or access sensitive system paths. - [COMMAND_EXECUTION]: The skill configures a
PostToolUsehook in.claude/settings.jsonthat executesauto-format-python.sh. This hook usesruffto automate code formatting and linting for Python files. The script safely parses environment-provided JSON input using an inline Python command. - [SAFE]: The skill implements a Phase 2 interactive workflow for filling out
CLAUDE.md. While this involves reading project metadata (likepackage.jsonorREADME.md) which could contain untrusted data, the skill mitigates indirect prompt injection risks by requiring explicit user confirmation viaAskUserQuestionbefore writing any generated content to disk.
Audit Metadata