scaffold-exercises
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands including
mkdir -pfor directory creation andgit mvorgit commitfor file management. - [COMMAND_EXECUTION]: It invokes a local CLI tool via
pnpm ai-hero-cli internal lintto perform validation on the generated files. - [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface as it processes a user-provided "plan" to generate directory names. While no active injection was found, the skill lacks explicit instructions to sanitize these names before passing them to the shell's
mkdircommand. - Ingestion points: User-provided exercise plan (SKILL.md)
- Boundary markers: None
- Capability inventory:
mkdir,git,pnpm(SKILL.md) - Sanitization: None
Audit Metadata