rhdh-plugin-authoring

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/scaffold.py uses subprocess.run to execute shell commands for environment setup, including npx, yarn install, and yarn new. These operations are used to create the Backstage application structure and generate plugin boilerplate.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install various dependencies and tools from official registries and trusted sources. This includes fetching the @backstage/create-app utility via npx and installing vendor-specific packages such as @red-hat-developer-hub/backstage-plugin-theme from NPM.
  • [REMOTE_CODE_EXECUTION]: The documentation in references/backstage-skills.md references the use of npx skills add https://backstage.io to add official Backstage migration and instrumentation skills. This command fetches and executes code from the official Backstage registry for development purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 08:21 AM