xl1-scaffold

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scaffolding utility in scripts/scaffold/writer.js uses spawnSync to execute corepack pnpm@10 for tasks such as installing dependencies, building the project, and running smoke tests on the generated output.
  • [EXTERNAL_DOWNLOADS]: The utility in scripts/scaffold/registry.js performs network requests to the official npm registry (https://registry.npmjs.org/) to resolve and fetch the latest versions of required packages during the scaffolding process.
  • [DATA_EXPOSURE]: The skill instructions provide guidance on using .env files for managing project configuration and sensitive credentials like seed phrases for local verification scripts, which follows standard developer practices for blockchain dApp development.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of software packages via the pnpm install and build commands. This is standard functionality for a project bootstrapper and targets well-known package registries.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 06:18 AM
Security Audit — agent-trust-hub — xl1-scaffold