univer-plugin-dev
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a TypeScript scaffolding script
scripts/scaffold-plugin.tsintended to be run locally by the user vianpx tsx. This script automates the creation of a plugin directory structure and populates it with boilerplate code. - [REMOTE_CODE_EXECUTION]: The scaffolding script generates a
package.jsonfile that includes dependencies for@univerjscore and UI packages. These are official packages for the Univer framework and are used appropriately within the context of the skill's purpose. - [DATA_EXFILTRATION]: No network operations targeting non-whitelisted domains or sensitive file access patterns were identified. The skill operates primarily on local project files.
- [PROMPT_INJECTION]: The instructions and metadata do not contain any patterns indicative of prompt injection, such as instructions to ignore safety filters or override system prompts.
- [SAFE]: The skill uses
quick_validate.py, which appears to be a standard validation utility within the platform's environment, to ensure the skill's integrity after modifications.
Audit Metadata