project-init-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/init-workspace.pyscript usessubprocess.run()to execute a scaffolding script from theagent-folder-initskill located in the local environment. This is used to initialize platform-specific documentation in the newly created project. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npx @shipshitdev/v0for primary project scaffolding. This involves downloading and executing a remote package. As the package belongs to the skill's author, it is classified as a legitimate vendor resource. - [SAFE]: The skill provides comprehensive templates for backend (NestJS), frontend (Next.js), and mobile (Expo) development. The generated code implements security best practices, including multi-tenancy enforced at the database level and secure session management. No malicious patterns such as prompt injection, obfuscation, or data exfiltration were detected.
Audit Metadata