scaffold-saas
Pass
Audited by Gen Agent Trust Hub on May 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to create temporary files, generate JSON configurations, and invoke the scaffolding CLI. It includes logic to build and run the tool locally if detected in the developer environment using
pnpm buildandnode. - [EXTERNAL_DOWNLOADS]: The skill uses
npx scaffoldo@latestto fetch and execute the project initialization tool from the npm registry. This is the primary function of the skill and uses the official package associated with the vendor. - [DATA_EXPOSURE]: The skill explicitly forbids reading or writing real API keys, restricting itself to
.env.exampletemplates and local project documentation. It implements safety checks to ensure the target directory is empty before proceeding.
Audit Metadata