rhdh-plugin-authoring
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/scaffold.pyusessubprocess.runto execute shell commands for environment setup, includingnpx,yarn install, andyarn new. These operations are used to create the Backstage application structure and generate plugin boilerplate. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install various dependencies and tools from official registries and trusted sources. This includes fetching the
@backstage/create-apputility vianpxand installing vendor-specific packages such as@red-hat-developer-hub/backstage-plugin-themefrom NPM. - [REMOTE_CODE_EXECUTION]: The documentation in
references/backstage-skills.mdreferences the use ofnpx skills add https://backstage.ioto add official Backstage migration and instrumentation skills. This command fetches and executes code from the official Backstage registry for development purposes.
Audit Metadata