scaffolding

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses tools like git init and bundles-forge bump-version to initialize repositories and manage versioning within the generated projects. These operations are essential to its function as a scaffolding tool.
  • [SAFE]: The skill provides robust guidance on external integrations, specifically recommending the use of userConfig with sensitive: true for Claude Code plugins. This ensures that API keys and tokens are stored in the system keychain rather than hardcoded in plaintext configuration files.
  • [SAFE]: The inclusion of the run-hook.cmd polyglot wrapper demonstrates a secure and portable approach to executing shell hooks across Windows and Unix-like environments without requiring dangerous global shell modifications.
  • [SAFE]: The provided bump_version.py script is a utility for synchronized version updates across multiple manifest files. It performs local file reads and writes within the project directory and does not exhibit any network or exfiltration capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 12:52 AM
Security Audit — agent-trust-hub — scaffolding