skills/sickn33/antigravity-awesome-skills/javascript-typescript-typescript-scaffold/Gen Agent Trust Hub
javascript-typescript-typescript-scaffold
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs local shell operations to initialize projects, including 'npm install -g pnpm', 'pnpm init', and 'git init'. These are routine developer tasks for environment setup and project scaffolding.
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes official scaffolding templates using 'pnpm create next-app' and 'pnpm create vite'. These target well-known, trusted registries (NPM) and are used for their intended purpose.
- [PROMPT_INJECTION]: The skill uses the '$ARGUMENTS' variable to ingest user requirements, creating a surface for indirect prompt injection where user input influences subsequent command generation.
- Ingestion points: User requirements provided in the '$ARGUMENTS' placeholder.
- Boundary markers: No explicit delimiters are used to separate user input from the skill's system instructions.
- Capability inventory: The agent has access to shell execution for directory creation, package installation, and project initialization.
- Sanitization: There is no evidence of input validation or escaping for the strings provided in the requirements block.
Audit Metadata