auto-init
Scaffolds AI automation for projects, configuring infrastructure and validating setups for hub or consumer roles.
Install this skill
Security score
The auto-init skill was audited on Apr 6, 2026 and we found 30 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 7 | You scaffold and configure AI automation for the current project. First asks whether this is the **hub** (full setup: all agents + Lambda + webhooks + AWS resources) or a **consumer** (PR + delegation |
Webhook reference - potential data exfiltration
| 82 | > **Which project is the automation hub?** This is the project that owns the Lambda functions and webhooks. Pipeline IDs from this repo will be registered in the hub's Lambda env vars. |
Webhook reference - potential data exfiltration
| 87 | > **Is this the main project for AI automation?** The main project owns all AWS infrastructure (Lambda, DynamoDB, webhooks) and runs all work-item-triggered agents. Other projects are consumers — they |
Webhook reference - potential data exfiltration
| 89 | > 1. **Yes — this is the hub** — Set up all agents + Lambda + webhooks + AWS resources |
Webhook reference - potential data exfiltration
| 152 | Scaffolding is profile-aware. Consumer profile gets a minimal subset — only pipeline YAMLs and config. They NEVER get Lambda handlers, webhook config, or AWS resource definitions. |
Webhook reference - potential data exfiltration
| 177 | **Consumer:** Copy ONLY the relevant subset — no Lambda, no webhook config, no AWS resource scripts: |
Webhook reference - potential data exfiltration
| 227 | - `hubProject`: from Question 5c (the project owning Lambda/webhooks) |
Webhook reference - potential data exfiltration
| 229 | - `webhooks.pr-answer`: entry for the repo-scoped PR Answer hook (URL left as placeholder — filled by `/auto-webhooks` using the hub's Lambda URL) |
Webhook reference - potential data exfiltration
| 253 | BASIC_USER= # Webhook basic auth username |
Webhook reference - potential data exfiltration
| 254 | BASIC_PASS= # Webhook basic auth password |
Webhook reference - potential data exfiltration
| 255 | WEBHOOK_SECRET= # Shared webhook secret header value |
Webhook reference - potential data exfiltration
| 346 | 5. `/auto-webhooks` — Configure ADO service hooks |
Webhook reference - potential data exfiltration
| 361 | **Hub project:** <hub project name> (owns Lambda + webhooks) |
Webhook reference - potential data exfiltration
| 379 | 3. `/auto-webhooks` — Create repo-scoped PR Answer hook + PR Review build policy |
Webhook reference - potential data exfiltration
| 412 | - **Non-hub repos MUST NOT touch AWS** — for `consumer` profile: never scaffold Lambda handlers, AWS resource definitions, deploy scripts, or CloudWatch alarms. Never ask for AWS region, resource pref |
Access to .env file
| 16 | | **Data bundle** (.ai/automation/) | Compare against plugin data → update silently if plugin files changed (preserving user-filled values in infra.json, repos.json, .env) | |
Access to .env file
| 18 | | **Generated files** (infra.json, repos.json, .env.template) | Validate structure and required fields exist — report missing fields from newer templates | |
Access to .env file
| 238 | ### 2.6. Generate `.ai/automation/.env.template` |
Access to .env file
| 242 | cat > .ai/automation/.env.template << 'EOF' |
Access to .env file
| 244 | # Copy to .env and fill in values. NEVER commit .env to git. |
Access to .env file
| 265 | **Consumer:** Generate a shorter `.env.template` with only the variables needed for pipeline agents (no Lambda/AWS vars): |
Access to .env file
| 267 | cat > .ai/automation/.env.template << 'EOF' |
Access to .env file
| 269 | # Copy to .env and fill in values. NEVER commit .env to git. |
Access to .env file
| 333 | - `.ai/automation/.env.template` — credential reference (copy to `.env`, never commit) |
Access to .env file
| 369 | - `.ai/automation/.env.template` — credential reference |
External URL reference
| 127 | > Example: `https://dev.azure.com/myorg/myproject/_wiki/wikis/MyWiki/123/Definition-of-Ready` |
External URL reference
| 134 | > Example: `https://author-myproject.adobeaemcloud.com` |
External URL reference
| 136 | > (Leave blank for local AEM author at `http://localhost:4502`) |
External URL reference
| 141 | > Example: `https://publish-myproject.adobeaemcloud.com` |
External URL reference
| 143 | > (Leave blank for local AEM publisher at `http://localhost:4503`) |