project-scripts

Warn

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill logic generates and executes shell scripts to manage project lifecycles. The script scripts/bootstrap.sh creates executable bash scripts on the local filesystem and applies chmod +x to them. Additionally, documentation in references/adapters.md notes that runtime configuration values may be passed to eval for execution.
  • [DATA_EXFILTRATION]: The skill targets sensitive environment configuration files for access. Both scripts/bootstrap.sh and the templates in references/ecosystem-templates.md contain instructions to copy or symlink files such as .env, .env.local, and .dev.vars which typically contain secrets.
  • [REMOTE_CODE_EXECUTION]: The skill scaffolds scripts that invoke standard package managers including npm, pnpm, bun, uv, and cargo to download and install dependencies from official remote registries.
  • [EXTERNAL_DOWNLOADS]: The skill integrates with the mise tool to manage development runtimes, using commands like mise install to download and configure software from well-known external sources.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 10, 2026, 03:57 AM