init-project
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to initialize the project environment, including 'git init' for repository creation and 'ln -s' to create a symbolic link for agent configuration files.- [COMMAND_EXECUTION]: Automated setup involves running 'pnpm install' for TypeScript projects and 'uv sync' for Python projects to install necessary dependencies.- [EXTERNAL_DOWNLOADS]: The skill downloads third-party dependencies from official registries (NPM and PyPI). It mitigates supply-chain risks by enforcing a 7-day minimum release age for new packages via 'minimumReleaseAge' and 'exclude-newer' configurations.- [COMMAND_EXECUTION]: User-provided project names are interpolated into file paths and shell commands. This constitutes an indirect injection surface where the agent's environment is responsible for sanitizing input to prevent command injection.- [COMMAND_EXECUTION]: The generated documentation suggests the use of standard linting and validation tools such as 'lychee', 'ruff', 'clippy', 'hadolint', and 'shellcheck'.
Audit Metadata