project-scaffold

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes official scaffolding tools such as create-next-app and npm create vite to generate project structures. These are industry-standard tools executed for their primary intended purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user input regarding framework and stack preferences to customize the scaffolded project.
  • Ingestion points: User stack preferences (framework, language, styling) provided in the initial prompt.
  • Boundary markers: None explicitly defined in the instructions.
  • Capability inventory: Executes shell commands for project creation, dependency installation (pnpm/npm), and build verification (npm run build/typecheck).
  • Sanitization: The instructions guide the use of official CLI flags to handle configurations, which mitigates common command injection risks.
  • [SAFE]: The skill includes explicit instructions to use .env.example for documentation and to never include real secrets, demonstrating good security hygiene for credential management.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 09:33 PM