sillytavern-extension-dev
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of local Node.js scripts designed for project scaffolding and manifest validation. The implementation avoids network operations and does not rely on external or untrusted dependencies.
- [DYNAMIC_EXECUTION]: Security is maintained by using static analysis techniques; the
validate-extension-manifest.mjsscript uses regular expressions to verify module exports rather than executing the target JavaScript files, which prevents the execution of untrusted code during the validation process. - [COMMAND_EXECUTION]: Both
scaffold-extension.mjsandvalidate-extension-manifest.mjsimplement strict path resolution and boundary checks. They explicitly verify that all file operations occur within the user-specified project root, and the scripts include checks to prevent operations on symbolic links, mitigating directory traversal and symlink-based attacks.
Audit Metadata