scaffold
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs environment discovery during its initialization phase (L1). It executes standard, non-malicious shell commands to identify available tools and system constraints, such as 'node -v', 'python3 --version', 'which npm', and 'git status'. These are used solely to inform architectural decisions.
- [DATA_EXPOSURE]: The skill includes a 'Harness Setup' (L3-5) that explicitly mentions blocking edits or writes to sensitive '.env*' files as a safety measure to prevent accidental exposure of credentials.
- [PROMPT_INJECTION]: The skill uses a 'Mirror Protocol' to confirm project goals with the user. This is a standard requirements-gathering technique and does not contain any patterns associated with instruction overrides or safety bypasses.
Audit Metadata