scaffold-project

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill clones starter repositories and downloads external templates from the Solana foundation and other developer catalogs. It leverages standard tools like git and npx to retrieve these resources.
  • [COMMAND_EXECUTION]: Shell commands are used to initialize project structures, manage local configuration files, and log telemetry events. These operations are scoped to the project directory and the user's ~/.superstack folder.
  • [REMOTE_CODE_EXECUTION]: The workflow utilizes npx skills add and npx create-solana-dapp to dynamically execute scaffolding and installation scripts. This is expected behavior for a developer-oriented environment setup tool.
  • [DATA_EXFILTRATION]: The skill collects non-sensitive environment metadata (such as platform architecture and OS) and usage metrics. These are sent to a telemetry endpoint defined in the user's local configuration. The telemetry process is documented, prompted, and can be disabled by the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 11:05 AM
Security Audit — agent-trust-hub — scaffold-project