datocms-plugin
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes an instruction to "Inspect silently". While flagged by static analysis as a concealment pattern, in the context of this developer-focused tool, it serves as a prompt engineering technique to reduce verbosity during the agent's initial context-gathering phase. It does not represent an attempt to bypass safety guardrails or hide malicious activities from the user.
- [COMMAND_EXECUTION]: The skill references standard shell commands such as
npm install,npm run build, andgrep. These are used for project scaffolding, validation, and searching within the plugin source code. These operations are standard for development workflows and are performed within the local project directory. - [EXTERNAL_DOWNLOADS]: The skill references official DatoCMS SDKs and UI libraries (
datocms-plugin-sdk,datocms-react-ui) as well as well-known third-party libraries (React, Lodash). All external resources are from trusted vendors or the official npm registry, aligned with the primary purpose of plugin development. - [SAFE]: The code examples demonstrate handling API keys provided by the user in plugin settings (e.g., Unsplash API). There are no patterns suggesting unauthorized access or exfiltration of sensitive files like credentials.
Audit Metadata