sillytavern-extension-builder
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or exfiltration attempts were detected. The skill provides legitimate developer tooling and documentation for the SillyTavern platform.
- [COMMAND_EXECUTION]: The skill utilizes a bash script (
scripts/scaffold_extension.sh) for file system operations during project scaffolding. The script correctly implements an escaping function to sanitize user-provided values, preventing injection into template substitution commands. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided metadata to generate code. Analysis of the attack surface shows: (1) Ingestion points: User requirements for extension features and identifiers in SKILL.md. (2) Boundary markers: Predefined templates in the assets/templates/ directory constrain the generated code structure. (3) Capability inventory: Subprocess calls in scripts/scaffold_extension.sh are limited to mkdir, cp, sed, and rm for local file system management. (4) Sanitization: The scripts/scaffold_extension.sh script sanitizes inputs used in sed, and references/extension-quality-guidelines.md provides explicit instructions on avoiding the execution of untrusted input in the resulting extensions.
Audit Metadata