xl1-scaffold
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The scaffolding utility in
scripts/scaffold/writer.jsusesspawnSyncto executecorepack pnpm@10for tasks such as installing dependencies, building the project, and running smoke tests on the generated output. - [EXTERNAL_DOWNLOADS]: The utility in
scripts/scaffold/registry.jsperforms network requests to the official npm registry (https://registry.npmjs.org/) to resolve and fetch the latest versions of required packages during the scaffolding process. - [DATA_EXPOSURE]: The skill instructions provide guidance on using
.envfiles for managing project configuration and sensitive credentials like seed phrases for local verification scripts, which follows standard developer practices for blockchain dApp development. - [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of software packages via the
pnpm installandbuildcommands. This is standard functionality for a project bootstrapper and targets well-known package registries.
Audit Metadata