streamling-plugin-basics

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a documentation and template resource for creating Streamling plugins. No malicious patterns, obfuscation, or unauthorized data access were detected.
  • [CREDENTIALS_UNSAFE]: The skill explicitly promotes secure credential handling. It provides a PluginOptions helper that instructs developers to fetch secrets from environment variables rather than plaintext YAML configuration, including a warning mechanism if secrets are detected in plaintext.
  • [EXTERNAL_DOWNLOADS]: Dependencies listed in the provided Cargo.toml (such as streamling-plugin, abi_stable, tokio, and arrow) are standard, versioned packages from the Rust ecosystem. The streamling-plugin crate is a legitimate vendor resource associated with the skill's author, goldsky-io.
  • [COMMAND_EXECUTION]: Code snippets demonstrate safe use of the Tokio async runtime for task management and sleep operations. There are no instances of arbitrary shell command execution or unsafe subprocess spawning.
  • [DATA_EXFILTRATION]: No network operations or file system access patterns targeting sensitive data were identified. The network capabilities mentioned (e.g., a 'rest_source' example) are consistent with the primary purpose of building data streaming plugins.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 09:28 PM
Security Audit — agent-trust-hub — streamling-plugin-basics