scaffold-project

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to execute the ux-ui-agent-skills package and npm to install the playwright testing library. These are standard practices for scaffolding and setting up a development environment.
  • [COMMAND_EXECUTION]: The skill executes various shell commands to facilitate project setup:
  • Environment checks using ls and echo.
  • Project scaffolding and tool installation using npx ux-ui-agent-skills.
  • Dependency management via npm i -D playwright.
  • Local script execution using python3.
  • [DYNAMIC_EXECUTION]: The skill runs local Python scripts (validate_contrast.py and validate_template.py) located within the skill's installation directory to validate design tokens and template integrity.
  • [DATA_EXPOSURE]: The skill explicitly instructs the user to set environment variables for secrets (e.g., FIGMA_API_KEY) and provides a warning: 'Never write a secret into .mcp.json', which is a positive security practice to prevent credential exposure in configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 11:01 AM