javascript-typescript-typescript-scaffold
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform standard project initialization tasks such as installing pnpm, initializing git repositories, and configuring project dependencies.
- [EXTERNAL_DOWNLOADS]: The skill uses
pnpm createto fetch project templates from well-known registries associated with the Next.js and Vite ecosystems, which are recognized as safe, established services. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided requirements to customize the generated project structure, creating an attack surface for indirect prompt injection.
- Ingestion points: User input via the
$ARGUMENTSvariable inSKILL.md. - Boundary markers: Absent; user requirements are directly interpreted by the agent without explicit delimiters.
- Capability inventory: File system creation, project initialization, and template execution.
- Sanitization: None; the skill relies on the agent's internal logic to process requirements into project files.
Audit Metadata