create-arc1-extension
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains no malicious patterns, obfuscation, or unauthorized data access attempts. It functions as a legitimate developer documentation and scaffolding tool.
- [COMMAND_EXECUTION]: Provides standard development shell commands (npm install, npm link, tsc) used to build and test extensions in a local environment. These are routine tasks for the intended developer audience.
- [EXTERNAL_DOWNLOADS]: References official vendor repositories and relevant third-party SAP integration tools on GitHub (LISA) to provide developers with worked examples and documentation. These are informational references and do not involve silent background downloads.
- [REMOTE_CODE_EXECUTION]: Explains the mechanism for loading local plugin files via the ARC1_PLUGINS environment variable. The skill explicitly notes security features of the loader, such as rejecting files with unsafe permissions (non-owner or world-writable), which serves as a security best practice instruction.
- [DATA_EXFILTRATION]: Outlines tool handlers for interacting with SAP APIs. The skill reinforces security boundaries by documenting that write operations and certain execution paths are gated by administrative environment variables and framework-level safety checks.
Audit Metadata