npx-cli
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scaffolding process and post-build scripts utilize
chmodto ensure that generated CLI binaries are executable by the end-user. This is standard and necessary functionality for command-line tool development. - [DYNAMIC_EXECUTION]: The
scaffold.tsscript generates project structure and source files by interpolating user-provided metadata, such as package names and descriptions, into predefined templates. This is a common pattern for scaffolding utilities. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input through command-line flags during the scaffolding process to populate file templates. While these inputs are interpolated without advanced sanitization, the behavior is localized to project creation and follows standard development practices for such tools.
Audit Metadata