javascript-typescript-typescript-scaffold
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The instructions include the installation of
pnpmand the use of standard scaffolding commands such aspnpm create next-appandpnpm create vite. These commands fetch project templates from well-known and established ecosystems. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements via the
$ARGUMENTSplaceholder to determine the project type. This input is used to select from predefined static templates (Next.js, Vite, Node.js API, or Library) provided within the skill instructions, minimizing the risk of arbitrary command execution. - [SAFE]: The skill implements security best practices by explicitly instructing the configuration of
.gitignoreto prevent the accidental exposure of sensitive environment variables (.env) and build artifacts.
Audit Metadata