init-project

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to initialize the project environment, including git init, ln -s, and package manager sync commands. While these are standard for project setup, the interpolation of the user-provided project name into shell commands represents a potential command injection surface if the environment does not provide automatic sanitization.- [EXTERNAL_DOWNLOADS]: During the post-setup phase, the skill executes pnpm install and uv sync. These operations connect to external package registries (npm and PyPI) to download and install dependencies required for the scaffolded project.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 03:00 PM