xl1-scaffold
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard pnpm lifecycle commands (install, build, test, lint) via the Node.js spawnSync API. These operations are essential for its primary function of project bootstrapping and verification.
- [EXTERNAL_DOWNLOADS]: The utility scripts fetch package metadata and version details from the official npm registry (registry.npmjs.org). This is a well-known, trusted service used to ensure that scaffolded projects incorporate the most recent compatible dependency versions.
- [SAFE]: The skill's instructions and scripts handle project configuration using .env files and capture blockchain 'floor blocks' for local development. These actions represent standard, secure development practices for blockchain-based applications and do not involve unauthorized data access.
Audit Metadata