uniappx-project-creator
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to use commands like
npx degit dcloudio/uni-preset-vue-xandnpm create uni-app-x@latestto bootstrap projects. These target official repositories and packages managed by the DCloud organization, which are standard tools for uni-app development. - [COMMAND_EXECUTION]: The skill includes shell command templates for project initialization (
npm install), development (npm run dev), and building (npm run build). These are standard lifecycle commands for web development projects and are presented as templates for the user's local execution. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an ingestion surface for potential indirect instructions through user-provided project names.
- Ingestion points: The skill accepts a project name from the user to populate creation commands and a shell script template in
templates/cli-commands.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the interpolation points.
- Capability inventory: The skill environment is designed to facilitate execution of
npx,npm, and shell scripts for project initialization. - Sanitization: No specific sanitization or validation of the user-provided project name is implemented before it is passed to shell commands.
Audit Metadata