scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent to use shell commands for directory management and version control, specifically
mkdir -pfor creating nested folders andgit mvorgit commitfor managing files. These commands are restricted to the localexercises/directory. - [COMMAND_EXECUTION]: The skill utilizes a project-specific CLI tool,
ai-hero-cli, to perform linting checks on the generated directory structure. This tool is invoked viapnpmand appears to be an internal utility for validating content structure. - [PROMPT_INJECTION]: The skill processes a 'plan' provided by the user to determine directory names. While this is an ingestion of untrusted data, the skill enforces specific naming conventions (dash-case and numeric prefixes) which limits the risk of command injection through filenames.
Audit Metadata