vellum-editorial
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Python initialization script (
scripts/init_project.py) to scaffold new projects. This script creates directories and writes project files based on user-provided arguments. It includes basic validation to ensure project names do not result in directory traversal. - [EXTERNAL_DOWNLOADS]: The generated templates are configured to fetch fonts from Google Fonts and icons from the Phosphor Icons CDN. These are established, well-known services used for standard web development purposes.
- [CREDENTIALS_UNSAFE]: The skill includes an optional client-side authentication gate using a non-cryptographic FNV-1a hash to manage access to the generated static pages. The documentation explicitly identifies this as a "courtesy gate" rather than a robust security mechanism, providing transparent guidance on its intended use case.
Audit Metadata