Skills genesis
📦

genesis

Content revision r2 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands

Create Modern Project Foundations

Starting a modern frontend or backend requires repeated setup and configuration. Genesis guides template-based or AI-generated foundations for React, FastAPI, Go Gin, and Taro.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "genesis" from https://skillstore.io/skills/bellybook-genesis.md and its manifest at https://skillstore.io/api/skills/bellybook-genesis/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/bellybook-genesis.md Signed manifest GET /api/skills/bellybook-genesis/manifest Signed lockfile GET /api/skills/bellybook-genesis/lockfile

Test it

Using "genesis". Create a React project named account-portal.

Expected outcome:

  • Project type: React 19, TypeScript, Vite, Tailwind CSS v4, and shadcn/ui.
  • Choose template copy or guided generation before any command runs.
  • Confirm the destination directory and review all installation commands.

Using "genesis". Plan a FastAPI backend using guided generation.

Expected outcome:

  • Foundation: FastAPI, UV, SQLModel, and AsyncPG.
  • Planned stages: environment, directories, core modules, and routes.
  • Deployment, authentication, and database provisioning require separate decisions.

Using "genesis". Prepare a Taro mini program for several platforms.

Expected outcome:

  • Targets: WeChat, Alipay, Douyin, and H5.
  • Foundation: Taro 4.x, React 18, Tailwind CSS v4, and weapp-tailwindcss.
  • Validate each platform build after reviewing dependency installation.

Security Audit

High Risk
v10 • 7/23/2026 Open versioned report

Most alerts are false positives from documentation URLs, standard Claude paths, UTF-8 Chinese text, and Markdown syntax. Four shell blocks execute filesystem, package, script, and server commands. They use unquoted user values and explicitly bypass confirmation, creating command injection and supply-chain execution risks.

3
Files scanned
427
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:60-62SKILL.md:88-90SKILL.md:114-118SKILL.md:149-154
Unquoted User Values in Shell Commands
Project names and target directories are inserted into shell commands without strict validation or quoting. Shell metacharacters could alter commands, overwrite unintended files, or execute additional processes.
The commands visibly interpolate target-directory and project-name placeholders without quoting. The checklist suggests a naming format but does not enforce or sanitize it.
High
SKILL.md:57-62SKILL.md:85-90SKILL.md:111-118SKILL.md:146-154
Unconfirmed Dependency and Process Execution
The skill explicitly directs immediate execution without confirmation, then installs dependencies and starts scripts or servers. Package lifecycle hooks and copied scripts can execute unreviewed code.
Each workflow says to execute without confirmation and then invokes npm, uv, a local shell script, or Go tooling. These commands cause direct side effects.
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:59-63
Ruby/shell backtick execution
```bash
The fenced Bash block copies files, edits package metadata, installs npm dependencies, and starts a development server. Although the detector mislabeled Markdown backticks, the block directs real process and filesystem execution.
Medium
SKILL.md:87-91
Ruby/shell backtick execution
```bash
The fenced Bash block copies and edits a project, resolves Python dependencies, and launches a local script. These commands create filesystem, dependency, and process side effects.
Medium
SKILL.md:113-119
Ruby/shell backtick execution
```bash
The fenced Bash block copies a Taro project, rewrites configuration, installs npm dependencies, and starts a WeChat development process. These are real external-command side effects.
Medium
SKILL.md:148-155
Ruby/shell backtick execution
```bash
The fenced Bash block copies a Go project, rewrites multiple files, resolves modules, and starts an API process. These commands have broad filesystem and process effects.

Risk Factors

🌐 Network access (2)
README.md:29 README.md:35
📁 Filesystem access (12)
README.md:35 README.md:41 README.md:35 README.md:41 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149
⚙️ External commands (15)
SKILL.md:18 SKILL.md:19 SKILL.md:34-45 SKILL.md:45-59 SKILL.md:59-63 SKILL.md:63-87 SKILL.md:87-91 SKILL.md:91-113 SKILL.md:113-119 SKILL.md:119-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-148 SKILL.md:148-155
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/bellybook-genesis/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/bellybook-genesis/security.svg)](https://skillstore.io/skills/bellybook-genesis?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/bellybook-genesis?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bellybook-genesis/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/bellybook-genesis.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

BellyBook. (2026). genesis security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/bellybook-genesis/audits/10

BibTeX citation

@techreport{bellybook-bellybook-genesis-2026, author = {BellyBook}, title = {genesis security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/bellybook-genesis/audits/10}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "genesis security audit report (audit version 10)" version: "unspecified" type: report authors: - name: "BellyBook" date-released: "2026-07-23" url: "https://skillstore.io/skills/bellybook-genesis/audits/10" identifiers: - type: other value: "skillstore:bellybook-genesis:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Start a React Application

Define a React 19 project foundation with Vite, TypeScript, Tailwind CSS v4, and shadcn/ui.

Plan a Backend Service

Outline a FastAPI or Go Gin service with the documented framework, configuration, and database libraries.

Prepare a Taro Mini Program

Plan one Taro codebase for WeChat, Alipay, Douyin, and H5 development targets.

Try These Prompts

Start a React Project 
Create a React project named {project_name} in {target_directory}. Show the initialization choices and wait for my selection before running commands.
Plan a Python API 
Plan a FastAPI project named {project_name}. Use guided generation, explain the file structure, and do not execute commands without approval.
Build a Cross-Platform Mini Program 
Create a Taro project for WeChat, Alipay, Douyin, and H5. Validate the project name and quote every shell path.
Design a Full Product Foundation 
Plan a React frontend and Go Gin API for {product}. Add landing-page structure, motion guidance, validation steps, and a security review.

Best Practices

  • Validate project names and quote every directory before using shell commands.
  • Inspect dependencies and scripts before installation or process startup.
  • Verify that every referenced template and guide exists before selecting either workflow.

Avoid

  • Do not pass unchecked project names or directories into shell commands.
  • Do not install packages or launch services without explicit user approval.
  • Do not assume referenced templates and guides exist in the installed package.

Frequently Asked Questions

Which project types does Genesis describe?
It covers React frontends, FastAPI backends, Go Gin APIs, and Taro mini programs.
Are the referenced templates included?
No. The audited package contains only README.md, SKILL.md, and LICENSE.
Does Genesis run commands automatically?
Its instructions request direct execution, but users should require review and approval before every command.
Do the shell examples work on every operating system?
No. The sed syntax targets macOS or BSD and needs adjustment elsewhere.
Does the workflow require network access?
Installation and dependency resolution can contact GitHub and package registries.
Does Genesis create production-ready systems?
No. Deployment, security controls, authentication, provisioning, and production hardening remain separate work.

Developer Details

Author

BellyBook

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/BellyBook/genesis/tree/main/

Ref

8c3e20bba512c392d9b02ee748b18e0b09d4982c

Maintenance freshness

7/24/2026

Usage

33 downloads · 223 views

File structure

📄 LICENSE

📄 README.md

📄 SKILL.md