scaffold-exercises

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill guides the agent to use shell commands for directory management and version control, specifically mkdir -p for creating nested folders and git mv or git commit for managing files. These commands are restricted to the local exercises/ directory.
  • [COMMAND_EXECUTION]: The skill utilizes a project-specific CLI tool, ai-hero-cli, to perform linting checks on the generated directory structure. This tool is invoked via pnpm and appears to be an internal utility for validating content structure.
  • [PROMPT_INJECTION]: The skill processes a 'plan' provided by the user to determine directory names. While this is an ingestion of untrusted data, the skill enforces specific naming conventions (dash-case and numeric prefixes) which limits the risk of command injection through filenames.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 01:56 AM
Security Audit — agent-trust-hub — scaffold-exercises