javascript-typescript-typescript-scaffold

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform standard project initialization tasks such as installing pnpm, initializing git repositories, and configuring project dependencies.
  • [EXTERNAL_DOWNLOADS]: The skill uses pnpm create to fetch project templates from well-known registries associated with the Next.js and Vite ecosystems, which are recognized as safe, established services.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided requirements to customize the generated project structure, creating an attack surface for indirect prompt injection.
  • Ingestion points: User input via the $ARGUMENTS variable in SKILL.md.
  • Boundary markers: Absent; user requirements are directly interpreted by the agent without explicit delimiters.
  • Capability inventory: File system creation, project initialization, and template execution.
  • Sanitization: None; the skill relies on the agent's internal logic to process requirements into project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 07:11 PM