Skills project-scaffolding

📦

project-scaffolding

Name: project-scaffolding
Author: hmohamed01

Content revision r1 High Risk 📁 Filesystem access⚙️ External commands🌐 Network access🔑 Env variables⚡ Contains scripts

Create Guided Project Scaffolds

New projects often require many setup choices before useful work can begin. This skill guides those choices and creates starter files for common software stacks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "project-scaffolding" from https://skillstore.io/skills/hmohamed01-project-scaffolding.md and its manifest at https://skillstore.io/api/skills/hmohamed01-project-scaffolding/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/hmohamed01-project-scaffolding.md Signed manifest GET /api/skills/hmohamed01-project-scaffolding/manifest Signed lockfile GET /api/skills/hmohamed01-project-scaffolding/lockfile

Test it

Using "project-scaffolding". Create a React TypeScript dashboard project.

Expected outcome:

Creates a project folder with source, public, test, and configuration directories.
Adds package metadata for React, Vite, TypeScript, testing, and optional Tailwind CSS.
Adds README, gitignore, environment example, and starter application files.

Using "project-scaffolding". Create a FastAPI service with PostgreSQL.

Expected outcome:

Creates application, API, database, model, schema, and test folders.
Adds dependency files, environment example, Docker templates, and database configuration.
Includes starter route, settings, testing, and migration support files.

Using "project-scaffolding". Create a browser extension starter.

Expected outcome:

Creates extension source folders for popup, background, and content behavior.
Adds TypeScript and build tooling configuration for extension development.
Includes documentation for local development and packaging steps.

Security Audit

High Risk

v8 • 7/9/2026 Open versioned report

Most static findings are false positives from markdown examples, scaffold templates, placeholder environment documentation, and generated project code. Confirmed issues are limited to explicit native CLI command guidance and a real unvalidated output path in the Python scaffolder. No prompt injection, credential exfiltration, or hidden network behavior was found.

Files scanned

6,863

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/scaffold.py:111-145 scripts/scaffold.py:1340-1349

Unvalidated Project Output Path

The CLI builds the output path from the base path and user-supplied project name without rejecting absolute paths or parent traversal. A crafted project name can create scaffold files outside the intended working directory.

ProjectConfig.name is joined directly with base_path before mkdir and template writes. No normalization or containment check is visible before files are created.

Capability review items (25)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/scaffold.py:1348

Python file write/append

with open(path, "w") as f:

The helper writes generated files to paths derived from the requested project output. This is core scaffolding behavior, but without path-boundary validation it contributes to directory-escape risk.

Medium

SKILL.md:76

Ruby/shell backtick execution

Use `scripts/scaffold.py` or native CLI tools to create the project structure.

The skill explicitly recommends native project generator commands such as npm, npx, Flutter, Go, Rust, or Spring tools. These are intended but can execute local or downloaded third-party code, so they require user confirmation.

Medium

SKILL.md:84

Ruby/shell backtick execution

| Next.js | `npx create-next-app@latest` |

Medium

SKILL.md:85

Ruby/shell backtick execution

| React (Vite) | `npm create vite@latest -- --template react-ts` |

Medium

SKILL.md:86

Ruby/shell backtick execution

| Vue | `npm create vue@latest` |

Medium

SKILL.md:87

Ruby/shell backtick execution

| Nuxt | `npx nuxi@latest init` |

Medium

SKILL.md:88

Ruby/shell backtick execution

| Astro | `npm create astro@latest` |

Medium

SKILL.md:89

Ruby/shell backtick execution

| Remix | `npx create-remix@latest` |

Medium

SKILL.md:90

Ruby/shell backtick execution

| SvelteKit | `npm create svelte@latest` |

Medium

SKILL.md:91

Ruby/shell backtick execution

| Solid | `npm create solid@latest` |

Medium

SKILL.md:92

Ruby/shell backtick execution

| Expo | `npx create-expo-app@latest` |

Medium

SKILL.md:93

Ruby/shell backtick execution

| React Native | `npx @react-native-community/cli init` |

Medium

SKILL.md:94

Ruby/shell backtick execution

| Flutter | `flutter create` |

Medium

SKILL.md:95

Ruby/shell backtick execution

| Tauri | `npm create tauri-app@latest` |

Medium

SKILL.md:96

Ruby/shell backtick execution

| NestJS | `npx @nestjs/cli new` |

Medium

SKILL.md:97

Ruby/shell backtick execution

| Spring Boot | `spring init` or start.spring.io |

Medium

SKILL.md:98

Ruby/shell backtick execution

| Go | `go mod init` |

Medium

SKILL.md:99

Ruby/shell backtick execution

| Rust | `cargo new` |

Medium

SKILL.md:100

Ruby/shell backtick execution

| Chrome Ext | `npm create plasmo@latest` |

Medium

SKILL.md:101

Ruby/shell backtick execution

| T3 Stack | `npx create-t3-app@latest` |

Medium

SKILL.md:106-111

Ruby/shell backtick execution

```bash

Medium

SKILL.md:130-132

Ruby/shell backtick execution

```bash

Medium

SKILL.md:135-137

Ruby/shell backtick execution

```bash

Medium

SKILL.md:140-142

Ruby/shell backtick execution

```bash

Medium

SKILL.md:145-147

Ruby/shell backtick execution

```bash

Risk Factors

📁 Filesystem access (7)

evaluation.json:60 scripts/scaffold.py:2935 scripts/scaffold.py:1173 scripts/scaffold.py:2167 scripts/scaffold.py:2935 scripts/scaffold.py:1311 scripts/scaffold.py:1348

⚙️ External commands (50)

🌐 Network access (15)

references/best-practices.md:214 references/best-practices.md:221 references/best-practices.md:735 references/best-practices.md:649 references/frameworks.md:107 references/frameworks.md:116 references/frameworks.md:308 references/frameworks.md:491 scripts/scaffold.py:682 scripts/scaffold.py:881 scripts/scaffold.py:1310 scripts/scaffold.py:1543 scripts/scaffold.py:1547 scripts/scaffold.py:2570 SKILL.md:121

🔑 Env variables (47)

⚡ Contains scripts (4)

scripts/scaffold.py:643 scripts/scaffold.py:1668 scripts/scaffold.py:1950 scripts/scaffold.py:2134

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/hmohamed01-project-scaffolding/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/hmohamed01-project-scaffolding/security.svg)](https://skillstore.io/skills/hmohamed01-project-scaffolding?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/hmohamed01-project-scaffolding?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/hmohamed01-project-scaffolding/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/hmohamed01-project-scaffolding.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

hmohamed01. (2026). project-scaffolding security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/hmohamed01-project-scaffolding/audits/8

BibTeX citation

@techreport{hmohamed01-hmohamed01-project-scaffolding-2026,
  author = {hmohamed01},
  title = {project-scaffolding security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/hmohamed01-project-scaffolding/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "project-scaffolding security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "hmohamed01"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/hmohamed01-project-scaffolding/audits/8"
identifiers:
  - type: other
    value: "skillstore:hmohamed01-project-scaffolding:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Start a frontend application

Create a React, Next.js, Vue, Svelte, Astro, or Angular starter with selected styling and testing options.

Bootstrap a backend service

Set up an API project with framework, database, ORM, environment, Docker, and testing templates.

Standardize team starters

Generate repeatable project layouts with shared linting, formatting, CI, and documentation conventions.

Try These Prompts

Create a static site

Create a simple static website named portfolio-site with responsive CSS and a README.

Create a React app

Create a React TypeScript project named dashboard-app with Tailwind CSS, testing, linting, and formatting.

Create a backend API

Create a FastAPI project named orders-api with SQLAlchemy, PostgreSQL, Docker, pytest, and GitHub Actions.

Create a monorepo

Create a Turborepo workspace named platform-suite with frontend, backend, shared packages, Docker, and CI templates.

Best Practices

Review generated configuration before installing dependencies or deploying the project.
Use a project name without path separators and keep output inside the workspace.
Replace placeholder secrets before running generated applications outside local development.