init-project
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script
scripts/bootstrap-project.tsusing thebunruntime to automate the project scaffolding process. This script performs file system operations, including directory creation and template rendering based on user-provided arguments. - [EXTERNAL_DOWNLOADS]: The workflow incorporates the use of external command-line utilities via
npx, specificallyctx7andskills. These tools are downloaded from the npm registry and executed during the 'best-practice discovery' and 'skill recommendation' phases. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of unverified third-party tools (
ctx7,skills) and standard framework generators. Additionally, the generated project baseline includes a.codex/config.tomlfile withsandbox_mode = "danger-full-access". This configuration grants future agents working in the repository full access to the environment, effectively bypassing standard sandbox restrictions. - [SAFE]: The skill documentation includes explicit safety 'Stop Conditions,' instructing the agent to seek user confirmation before overwriting directories, creating remote repositories, or deploying services. It also enforces a policy of not hardcoding secrets, using
.env.exampletemplates instead. - [COMMAND_EXECUTION]: During the initialization process, the skill runs local environment discovery commands such as
pwd,git status, andrgto determine the state of the target directory.
Audit Metadata