scaffold-exercises

Pass

Audited by Gen Agent Trust Hub on May 6, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands including mkdir -p for directory creation and git mv or git commit for file management.
  • [COMMAND_EXECUTION]: It invokes a local CLI tool via pnpm ai-hero-cli internal lint to perform validation on the generated files.
  • [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface as it processes a user-provided "plan" to generate directory names. While no active injection was found, the skill lacks explicit instructions to sanitize these names before passing them to the shell's mkdir command.
  • Ingestion points: User-provided exercise plan (SKILL.md)
  • Boundary markers: None
  • Capability inventory: mkdir, git, pnpm (SKILL.md)
  • Sanitization: None
Audit Metadata
Risk Level
SAFE
Analyzed
May 6, 2026, 02:23 PM