init-project
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to initialize the project environment, including
git init,ln -s, and package manager sync commands. While these are standard for project setup, the interpolation of the user-provided project name into shell commands represents a potential command injection surface if the environment does not provide automatic sanitization.- [EXTERNAL_DOWNLOADS]: During the post-setup phase, the skill executespnpm installanduv sync. These operations connect to external package registries (npm and PyPI) to download and install dependencies required for the scaffolded project.
Audit Metadata