fullstack-init

Pass

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to set up the project environment. This includes creating directory structures using mkdir and initializing projects using framework-specific CLIs like nest new and pnpm create vue. These are standard and necessary actions for a project scaffolding tool.
  • [EXTERNAL_DOWNLOADS]: The skill automates the installation of numerous third-party libraries and frameworks from the public NPM registry, such as NestJS, Prisma, Vue3, and Element Plus. These downloads are from well-known, standard sources and are required for the project's functionality.
  • [PROMPT_INJECTION]: The skill implements a configuration synchronization feature that reads data from a user-editable CONFIG.md file and writes it to .env files. This creates a surface for indirect prompt injection where data ingested from an external file affects the environment configuration. The skill lacks explicit sanitization or boundary markers for this ingestion process.
  • [CREDENTIALS_UNSAFE]: The project templates include placeholders and example values for environment variables, such as database hosts (e.g., 101.34.89.199) and usernames. These are provided for illustrative purposes in documentation and configuration templates and should be replaced by users with secure credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 11, 2026, 10:40 AM