bootstrap
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Environment Variable Management: The skill interacts with
.envfiles and Vercel environment variables to synchronize secrets and configuration. It includes explicit rules to avoid echoing or logging secret values, and uses local shell utilities (grep,cut,comm) to compare variable names rather than their values. - Shell Command Execution: The skill executes several shell commands using the
vercelCLI,npm/pnpm/bun/yarn, and standard Linux utilities. These are used for project linking, package management, and resource provisioning. While these commands have broad capabilities, they are used here within the context of repo initialization and maintenance. - Automated Secret Generation: It uses a
nodeone-liner to generate a high-entropyAUTH_SECRETlocally. This value is passed directly to the Vercel CLI via a pipe and then immediately unset from the shell environment to minimize exposure in memory or history. - External Resource Configuration: The skill uses
npx shadcn@latestto add UI primitives andvercel integrationto link external database providers (like Neon). These operations involve downloading or interacting with external services as part of the intended setup process. - Indirect Data Ingestion: The orchestrator reads local project files such as
.env.exampleandpackage.jsonto determine necessary setup steps. While reading project files is a common surface for indirect prompt injection, the skill mitigates this by focusing on structured patterns (like environment variable keys) rather than executing instructions found within those files.
Audit Metadata