develop-timeline-studio-plugin
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the integration of third-party provider APIs and SDKs into a core application, creating a potential attack surface for untrusted external data.
- Ingestion points: External provider documentation, API response payloads, and browser SDKs as described in
SKILL.md. - Boundary markers: The instructions in
SKILL.mdexplicitly mandate the use of an "isolated adapter" and a "declarative manifest" to maintain strict boundaries between providers and the editor core. - Capability inventory: The skill involves modifying source code files (e.g.,
src/components/GenerationPlugins.jsx) and executing build toolchains (npm run build) as noted inSKILL.md. - Sanitization: Implementation requirements in
SKILL.mdinclude converting raw transport failures into localized errors without leaking secrets and performing media validation before reporting completion. - [COMMAND_EXECUTION]: The instructions in
SKILL.mddirect the agent to execute local development tools, includingnpm run lint,npm run typecheck, andnpm run build, to validate the implementation of new connectors.
Audit Metadata