swain-init
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the installation script for the
uvtool from Astral's official domain (astral.sh).\n- [REMOTE_CODE_EXECUTION]: Executes theuvinstaller by piping the remote script directly into the shell (curl ... | sh).\n- [COMMAND_EXECUTION]: Installs thepre-commitframework usinguv tool installand configures local git hooks viapre-commit installto automate security checks.\n- [EXTERNAL_DOWNLOADS]: Sets up.pre-commit-config.yamlto reference and download security scanning hooks (including gitleaks and trufflehog) from their respective GitHub repositories.\n- [COMMAND_EXECUTION]: Usesnpxto add and install theobra/superpowersskill and executes a vendored script namedtkfound within the project structure.\n- [COMMAND_EXECUTION]: Programmatically invokes other local skills (swain-doctor,swain-help) to verify project health and provide user onboarding.
Audit Metadata