create-canvas-extension
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Executes repository-specific scripts including
npm run plugin:validate,npm run build, andnpm run website:datato verify the scaffolded extension. These commands are standard for the development lifecycle of the target repository.\n- [PROMPT_INJECTION]: Ingests user-provided metadata (name, description, author) to populateplugin.jsonmanifests. This represents a standard indirect prompt injection surface for scaffolding tools.\n - Ingestion points: User input for Extension ID and display metadata requested during execution (SKILL.md).\n
- Boundary markers: No specific delimiters are applied to user input within the manifest templates.\n
- Capability inventory: File system write operations and execution of npm build/validation scripts (SKILL.md).\n
- Sanitization: Relies on the user for valid inputs and the
npm run plugin:validatescript for schema verification.\n- [EXTERNAL_DOWNLOADS]: References a plugin schema fromagent-plugins.org. This is a standard resource for manifest validation and does not involve the execution of untrusted external code.
Audit Metadata