create-uploader-plugin

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a PowerShell script new-uploader-plugin.ps1 used to automate the creation of new plugin projects. It executes standard developer commands like dotnet sln add to register new projects within the solution structure.
  • [CREDENTIALS_SAFE]: The generated code templates and skill instructions specifically enforce the use of ISecretStore for managing sensitive information like API tokens. The instructions explicitly warn against storing secrets in plain text configuration files, promoting secure credential management.
  • [DYNAMIC_EXECUTION]: The skill targets a plugin-based architecture where generated DLLs are intended to be dynamically loaded by a host application. The project templates include <EnableDynamicLoading>true</EnableDynamicLoading>, which is a standard and necessary configuration for this specific software architecture.
  • [INDIRECT_PROMPT_INJECTION]: The scaffolding script processes user-supplied strings for the plugin name and ID. It employs regex-based sanitization (via Convert-ToPascalCase and Convert-ToPluginId) to ensure that inputs used for file names, namespaces, and IDs are restricted to alphanumeric characters, effectively mitigating path traversal or command injection risks during the generation process.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 09:34 AM