scaffold-exercises

Pass

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several shell commands to manage files and directories:
  • mkdir -p for directory creation based on naming conventions.
  • git mv and git commit for version control management.
  • pnpm ai-hero-cli internal lint to validate the created structure against predefined rules.
  • [PROMPT_INJECTION]: The skill is designed to parse a "plan" provided in the conversation context to extract exercise and section names. While this processes untrusted data, the extracted strings are used only as identifiers for directory and file creation, which is a routine and low-risk operation.
  • [EXTERNAL_DOWNLOADS]: The skill uses pnpm, a standard Node.js package manager, to run a local CLI tool (ai-hero-cli). It does not appear to download arbitrary external scripts or execute code from untrusted remote sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 25, 2026, 12:34 AM
Security Audit — agent-trust-hub — scaffold-exercises