adk-scaffold
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- External Script Execution: The documentation provides a troubleshooting step that downloads and executes an installation script for the
uvtool from its official domain. This is a common installation pattern for this developer utility. - Remote Tool Execution: The skill utilizes
uvxto fetch and execute theagent-starter-packtool directly from a package registry. This ensures the agent uses the most current version of the scaffolding logic provided by the tool's author. - Command Execution: The skill's primary function involves running CLI commands to manage project files and infrastructure, requiring the ability to execute subprocesses.
- Indirect Prompt Injection Surface: The skill processes user-defined project requirements and includes them in generated commands and specifications. (1) Ingestion points: User input for project requirements gathered in Step 1 of
SKILL.md. (2) Boundary markers: None identified in the provided templates. (3) Capability inventory: Execution ofuvx,curl, andpipas described inSKILL.md. (4) Sanitization: No specific validation or escaping of user-provided project metadata is mentioned.
Audit Metadata