Skip to content
skillsafebeta
← Report library
Purpose / Other

Scaffold Exercises Skill Security Audit

What the author says it does (original text)

Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.

Independent security check

Security risks found

Files checked
2
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The Skill directs an automatic Git commit beyond its core exercise-scaffolding purpose

Source references: 4
What we found

The description promises exercise-structure creation, but the body additionally requires a `git commit` afterward. A commit permanently changes repository history, and the instruction does not require showing the diff, confirming the commit scope, or obtaining user approval.

Why this matters

If followed, unreviewed scaffold changes will be recorded in repository history. Any unrelated changes already staged at commit time could also be included.

The stated purpose is to scaffold lint-ready exercise directories, but the live instruction also requires `git commit`. When the skill is used for scaffolding, this would modify repository history without a workflow step to show the changes, limit the commit contents, or obtain approval. A user can prohibit automatic commits and ask the author to make committing a separate, opt-in confirmation step.

SKILL.md:2In the instructionsOpen original file
---name: scaffold-exercisesdescription: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.---
Show 3 other places
SKILL.md:8In the instructionsOpen original file
Create exercise directory structures that pass `pnpm ai-hero-cli internal lint`, then commit with `git commit`.
SKILL.md:3In the instructionsOpen original file
name: scaffold-exercisesdescription: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.---
SKILL.md:46In the instructionsOpen original file
1. **Parse the plan** - extract section names, exercise names, and variant types2. **Create directories** - `mkdir -p` for each path3. **Create stub readmes** - one `readme.md` per variant folder with a title4. **Run lint** - `pnpm ai-hero-cli internal lint` to validate5. **Fix any errors** - iterate until lint passes
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

The Skill’s main behavior is to create section, exercise, and variant directories under `exercises/`, then write a non-empty `readme.md` for each variant.

View source
SKILL.md:46In the instructionsOpen original file
1. **Parse the plan** - extract section names, exercise names, and variant types2. **Create directories** - `mkdir -p` for each path3. **Create stub readmes** - one `readme.md` per variant folder with a title4. **Run lint** - `pnpm ai-hero-cli internal lint` to validate

After creating files, the Skill runs a project pnpm CLI for validation and is instructed to keep making fixes until it passes.

View source
SKILL.md:49In the instructionsOpen original file
3. **Create stub readmes** - one `readme.md` per variant folder with a title4. **Run lint** - `pnpm ai-hero-cli internal lint` to validate5. **Fix any errors** - iterate until lint passes

When moving or renumbering exercises, the Skill instructs the agent to use `git mv`, producing Git-tracked path changes.

View source
SKILL.md:67In the instructionsOpen original file
When renumbering or moving exercises:1. Use `git mv` (not `mv`) to rename directories - preserves git history2. Update the numeric prefix to maintain order3. Re-run lint after moves
Start here · InstructionsSKILL.md
scaffold-exercises
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:75In the instructionsOpen original file
```bashgit mv exercises/01-retrieval/01.03-embeddings exercises/01-retrieval/01.04-embeddings
SKILL.md:92In the instructionsOpen original file
```bashmkdir -p exercises/05-memory-skill-building/05.01-introduction-to-memory/explainer
Change files
SKILL.md:76In the instructionsOpen original file
```bashgit mv exercises/01-retrieval/01.03-embeddings exercises/01-retrieval/01.04-embeddings```
Lines read
111
File checksum (to compare versions)
5ddbe8357bf0aa632be416595b85d4d96f67250576de1ee02b80b1ccf11e6707