vellum-editorial

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a Python initialization script (scripts/init_project.py) to scaffold new projects. This script creates directories and writes project files based on user-provided arguments. It includes basic validation to ensure project names do not result in directory traversal.
  • [EXTERNAL_DOWNLOADS]: The generated templates are configured to fetch fonts from Google Fonts and icons from the Phosphor Icons CDN. These are established, well-known services used for standard web development purposes.
  • [CREDENTIALS_UNSAFE]: The skill includes an optional client-side authentication gate using a non-cryptographic FNV-1a hash to manage access to the generated static pages. The documentation explicitly identifies this as a "courtesy gate" rather than a robust security mechanism, providing transparent guidance on its intended use case.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 05:16 PM