config-project-fullstack

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/create-project.js utilizes child_process.spawnSync to execute shell commands including npm, npx, and nest. These commands are used to initialize the project, install dependencies, and verify the local environment. Input parameters such as the project namespace are validated using regular expressions to prevent command injection.
  • [EXTERNAL_DOWNLOADS]: The skill triggers the download of project templates and packages from the official NPM registry using npx create-turbo@latest, npx create-next-app@latest, and npm install @nestjs/config. These operations target well-known, trusted package registries for the Node.js ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:47 PM
Security Audit — agent-trust-hub — config-project-fullstack