uniappx-project-creator

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to use commands like npx degit dcloudio/uni-preset-vue-x and npm create uni-app-x@latest to bootstrap projects. These target official repositories and packages managed by the DCloud organization, which are standard tools for uni-app development.
  • [COMMAND_EXECUTION]: The skill includes shell command templates for project initialization (npm install), development (npm run dev), and building (npm run build). These are standard lifecycle commands for web development projects and are presented as templates for the user's local execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an ingestion surface for potential indirect instructions through user-provided project names.
  • Ingestion points: The skill accepts a project name from the user to populate creation commands and a shell script template in templates/cli-commands.md.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the interpolation points.
  • Capability inventory: The skill environment is designed to facilitate execution of npx, npm, and shell scripts for project initialization.
  • Sanitization: No specific sanitization or validation of the user-provided project name is implemented before it is passed to shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 04:38 AM