scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to manage files and directories:
mkdir -pfor directory creation based on naming conventions.git mvandgit commitfor version control management.pnpm ai-hero-cli internal lintto validate the created structure against predefined rules.- [PROMPT_INJECTION]: The skill is designed to parse a "plan" provided in the conversation context to extract exercise and section names. While this processes untrusted data, the extracted strings are used only as identifiers for directory and file creation, which is a routine and low-risk operation.
- [EXTERNAL_DOWNLOADS]: The skill uses
pnpm, a standard Node.js package manager, to run a local CLI tool (ai-hero-cli). It does not appear to download arbitrary external scripts or execute code from untrusted remote sources.
Audit Metadata