light-project-structure

Pass

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/scaffold.py script uses subprocess.run to initialize version control and data tracking by executing git init and dvc init. These commands are executed with hardcoded argument lists, and the target directory is resolved from user input, which is a safe and intended functionality of a project scaffolding tool.
  • [EXTERNAL_DOWNLOADS]: The templates/pre-commit-config.template.yaml file references external pre-commit hooks from the astral-sh and pre-commit GitHub organizations. These are well-known, trusted development tools used for code linting and formatting.
  • [DATA_EXPOSURE]: The skill instructions include steps to analyze existing project files, such as README.md and setup scripts, to assist in organizing legacy projects. This behavior is consistent with the skill's primary purpose and involves reading local project data within the agent's operating context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 17, 2026, 01:44 AM
Security Audit — agent-trust-hub — light-project-structure