scaffolding
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses tools like
git initandbundles-forge bump-versionto initialize repositories and manage versioning within the generated projects. These operations are essential to its function as a scaffolding tool. - [SAFE]: The skill provides robust guidance on external integrations, specifically recommending the use of
userConfigwithsensitive: truefor Claude Code plugins. This ensures that API keys and tokens are stored in the system keychain rather than hardcoded in plaintext configuration files. - [SAFE]: The inclusion of the
run-hook.cmdpolyglot wrapper demonstrates a secure and portable approach to executing shell hooks across Windows and Unix-like environments without requiring dangerous global shell modifications. - [SAFE]: The provided
bump_version.pyscript is a utility for synchronized version updates across multiple manifest files. It performs local file reads and writes within the project directory and does not exhibit any network or exfiltration capabilities.
Audit Metadata