project-init-orchestrator

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/init-workspace.py script uses subprocess.run() to execute a scaffolding script from the agent-folder-init skill located in the local environment. This is used to initialize platform-specific documentation in the newly created project.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx @shipshitdev/v0 for primary project scaffolding. This involves downloading and executing a remote package. As the package belongs to the skill's author, it is classified as a legitimate vendor resource.
  • [SAFE]: The skill provides comprehensive templates for backend (NestJS), frontend (Next.js), and mobile (Expo) development. The generated code implements security best practices, including multi-tenancy enforced at the database level and secure session management. No malicious patterns such as prompt injection, obfuscation, or data exfiltration were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 04:47 PM