scaffold-saas

Pass

Audited by Gen Agent Trust Hub on May 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to create temporary files, generate JSON configurations, and invoke the scaffolding CLI. It includes logic to build and run the tool locally if detected in the developer environment using pnpm build and node.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx scaffoldo@latest to fetch and execute the project initialization tool from the npm registry. This is the primary function of the skill and uses the official package associated with the vendor.
  • [DATA_EXPOSURE]: The skill explicitly forbids reading or writing real API keys, restricting itself to .env.example templates and local project documentation. It implements safety checks to ensure the target directory is empty before proceeding.
Audit Metadata
Risk Level
SAFE
Analyzed
May 3, 2026, 03:50 PM