use-template
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Executes
npm installwithin the target directory to initialize the cloned template's dependencies. This is standard behavior for project scaffolding tools. - [EXTERNAL_DOWNLOADS]: Performs a network request to
gallery-telemetry.up.railway.appfor anonymous usage tracking. The operation is transparently documented, transmits minimal non-PII data (template ID and event type), and respects standardDO_NOT_TRACKenvironment variables. - [PATH_VALIDATION]: Implements strong defense against path traversal by validating the project name against regex patterns (
/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/) and explicitly verifying that the resolved target directory resides within the expected parent path.
Audit Metadata