export-and-package
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the Red Hat Developer Hub CLI tool via
npxto perform the plugin export and packaging process. - The tool
@red-hat-developer-hub/cliis an official utility provided by the vendor for managing dynamic plugins. - Remote execution is constrained to this specific, legitimate developer tool as part of the intended build pipeline.
- [COMMAND_EXECUTION]: The automation script
scripts/export-plugin.pyexecutes system commands to build and package software artifacts. - The script uses
subprocess.run()with argument lists to invokeyarn,npm,podman,docker, andnpx. - By passing arguments as lists rather than shell strings, the script avoids common command injection vulnerabilities.
- The script provides an option to clean build artifacts using
shutil.rmtree, which is restricted to the localdistanddist-dynamicdirectories.
Audit Metadata