scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands like
mkdir -pto create nested directory structures andgit mvto rename or move exercise folders while preserving git history. It also callspnpm ai-hero-cli internal lintto validate the created structure. These actions are within the expected scope of a scaffolding tool. - [INDIRECT_PROMPT_INJECTION]: The skill takes user-supplied exercise plans to generate file system paths and basic Markdown content. \n
- Ingestion points: User-provided exercise plans or section names (referenced in the workflow section of SKILL.md). \n
- Boundary markers: None identified. \n
- Capability inventory: Local file system access (mkdir, git mv) and command execution (pnpm). \n
- Sanitization: There is no mention of sanitizing or validating the input strings before they are used in shell commands.
Audit Metadata