tauri-app-creator
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a non-standard package
tauri-plugin-creatorwithin the code snippets inexamples/usage.md. While used for illustrative purposes, this package is not a part of the official Tauri core plugins and could represent a supply chain risk if a malicious package were published under that name. - [PROMPT_INJECTION]: The skill employs template interpolation in
templates/basic.mdusing placeholders like{project_name}and{frontend}. This identifies a surface for indirect prompt injection where malicious user-provided values could attempt to influence the generated configuration or shell commands. - Ingestion points: User-supplied project metadata used in
templates/basic.md. - Boundary markers: Absent; the variables are interpolated directly into the markdown template.
- Capability inventory: The skill facilitates the generation of filesystem structures and the execution of package manager commands (npm, cargo, etc.).
- Sanitization: No explicit sanitization or validation logic is defined for the interpolated variables.
Audit Metadata