create-canvas-extension
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local build and validation commands (
npm run plugin:validate,npm run build,npm run website:data). These are standard project-level lifecycle scripts for the target repositorygithub/awesome-copilotand do not involve remote code execution or privilege escalation. - [REMOTE_CODE_EXECUTION]: The skill references an external schema URL (
https://agent-plugins.org/schemas/1.0.0/plugin.schema.json) for validation purposes within a JSON file. This is a static reference to a well-known schema hosting service and does not execute remote code.
Audit Metadata