create-uploader-plugin
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a PowerShell script
new-uploader-plugin.ps1used to automate the creation of new plugin projects. It executes standard developer commands likedotnet sln addto register new projects within the solution structure. - [CREDENTIALS_SAFE]: The generated code templates and skill instructions specifically enforce the use of
ISecretStorefor managing sensitive information like API tokens. The instructions explicitly warn against storing secrets in plain text configuration files, promoting secure credential management. - [DYNAMIC_EXECUTION]: The skill targets a plugin-based architecture where generated DLLs are intended to be dynamically loaded by a host application. The project templates include
<EnableDynamicLoading>true</EnableDynamicLoading>, which is a standard and necessary configuration for this specific software architecture. - [INDIRECT_PROMPT_INJECTION]: The scaffolding script processes user-supplied strings for the plugin name and ID. It employs regex-based sanitization (via
Convert-ToPascalCaseandConvert-ToPluginId) to ensure that inputs used for file names, namespaces, and IDs are restricted to alphanumeric characters, effectively mitigating path traversal or command injection risks during the generation process.
Audit Metadata