project-scaffold
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes official scaffolding tools such as
create-next-appandnpm create viteto generate project structures. These are industry-standard tools executed for their primary intended purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input regarding framework and stack preferences to customize the scaffolded project.
- Ingestion points: User stack preferences (framework, language, styling) provided in the initial prompt.
- Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Executes shell commands for project creation, dependency installation (pnpm/npm), and build verification (npm run build/typecheck).
- Sanitization: The instructions guide the use of official CLI flags to handle configurations, which mitigates common command injection risks.
- [SAFE]: The skill includes explicit instructions to use
.env.examplefor documentation and to never include real secrets, demonstrating good security hygiene for credential management.
Audit Metadata