rightcode-scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including
mkdir,git mv,git commit, andpnpmto create directories and manage files within the workspace. These operations are essential to its documented purpose. - [PROMPT_INJECTION]: The workflow involves parsing a user-provided "plan" to determine the names and types of directories to be created. This introduces an indirect prompt injection surface where a maliciously crafted plan could attempt to execute command injection or influence agent behavior.
- Ingestion points: The skill parses a "plan" in the first step of the workflow described in
SKILL.md. - Boundary markers: There are no explicit delimiters or instructions provided to isolate or ignore malicious content within the plan.
- Capability inventory: The skill uses
mkdir,git, andpnpmfor file system and project management as defined inSKILL.md. - Sanitization: No input validation or sanitization procedures are specified for the names or content derived from the plan before they are used in shell commands.
Audit Metadata