scaffold-project
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto execute theux-ui-agent-skillspackage andnpmto install theplaywrighttesting library. These are standard practices for scaffolding and setting up a development environment. - [COMMAND_EXECUTION]: The skill executes various shell commands to facilitate project setup:
- Environment checks using
lsandecho. - Project scaffolding and tool installation using
npx ux-ui-agent-skills. - Dependency management via
npm i -D playwright. - Local script execution using
python3. - [DYNAMIC_EXECUTION]: The skill runs local Python scripts (
validate_contrast.pyandvalidate_template.py) located within the skill's installation directory to validate design tokens and template integrity. - [DATA_EXPOSURE]: The skill explicitly instructs the user to set environment variables for secrets (e.g.,
FIGMA_API_KEY) and provides a warning: 'Never write a secret into .mcp.json', which is a positive security practice to prevent credential exposure in configuration files.
Audit Metadata