sillytavern-extension-dev
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements local Node.js scripts (
scaffold-extension.mjs,validate-extension-manifest.mjs,check-extension-capabilities.mjs) to automate the development lifecycle of UI extensions. These scripts perform static validation of JSON manifests and use regular expressions to inspect source code for exports without executing the code itself. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data as it reads and processes third-party extension manifests and source files provided by the user.
- Ingestion points: Files are read in
scripts/validate-extension-manifest.mjsandscripts/check-extension-capabilities.mjsusingfs.readFileSyncbased on user-supplied path arguments. - Boundary markers: The
SKILL.mdinstructions explicitly separate static validation from runtime acceptance and warn against installation without user authorization. - Capability inventory: The scripts possess file system read/write capabilities but no network access.
scaffold-extension.mjscan create directories and write files to a designated output root. - Sanitization: Both the validator and the scaffolder implement robust path traversal checks using
path.resolveand verifying that resolved paths remain within the intended root directory (e.g.,resolved.startsWith(root)). This effectively mitigates directory traversal attacks via malicious manifest paths.
Audit Metadata