scaffold-project
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones starter repositories and downloads external templates from the Solana foundation and other developer catalogs. It leverages standard tools like
gitandnpxto retrieve these resources. - [COMMAND_EXECUTION]: Shell commands are used to initialize project structures, manage local configuration files, and log telemetry events. These operations are scoped to the project directory and the user's
~/.superstackfolder. - [REMOTE_CODE_EXECUTION]: The workflow utilizes
npx skills addandnpx create-solana-dappto dynamically execute scaffolding and installation scripts. This is expected behavior for a developer-oriented environment setup tool. - [DATA_EXFILTRATION]: The skill collects non-sensitive environment metadata (such as platform architecture and OS) and usage metrics. These are sent to a telemetry endpoint defined in the user's local configuration. The telemetry process is documented, prompted, and can be disabled by the user.
Audit Metadata