scaffold-cli-tool
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a development guide and template provider for building CLI tools using established frameworks like Cobra (Go) and Commander (Node.js). The code snippets provided are benign boilerplate for command routing, configuration loading, and output formatting.
- [EXTERNAL_DOWNLOADS]: The instructions reference well-known, industry-standard libraries and tools including
spf13/cobra,commander,goreleaser,cosign, andpino. These references are standard for the described development workflow. - [CREDENTIALS_SAFE]: The skill advocates for secure configuration practices, specifically recommending the use of XDG-compliant configuration directories (e.g.,
~/.config/) and environment variable overrides instead of hardcoding sensitive data or polluting the user's home directory with dotfiles. - [REMOTE_CODE_EXECUTION]: While the skill mentions release tools like
goreleaserandnp, it does not include any commands that automatically download or execute remote scripts during the agent's interaction. All mentioned tools are intended for the developer's local environment.
Audit Metadata