uniappx-project-creator
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches project templates from the official DCloud (dcloudio) GitHub organization using the
npx degitcommand. - [REMOTE_CODE_EXECUTION]: Utilizes
npm installandnpm createto download and execute remote packages from the npm registry as part of the project initialization process. - [COMMAND_EXECUTION]: The skill provides templates in
templates/cli-commands.mdthat interpolate user-provided project names directly into shell commands (e.g.,npx degit dcloudio/uni-preset-vue-x $PROJECT_NAME). This pattern represents a potential command injection surface because it lacks boundary markers or explicit sanitization instructions. Ingestion points: project name provided in user request; Boundary markers: absent; Capability inventory: shell execution via npx and npm; Sanitization: absent.
Audit Metadata