stac-custom-extensions
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local Python scripts to automate the generation of Dart model and parser files. These scripts operate within the local project environment and do not invoke shell commands with unvalidated user input.
- [DATA_EXFILTRATION]: The skill scripts interact with the local filesystem to read project files for registration checks and write new code files. These operations are scoped to user-specified paths and do not access sensitive system locations or exfiltrate data to external networks.
- [INDIRECT_PROMPT_INJECTION]: The scaffolding scripts take user-provided strings for class names and type identifiers and interpolate them into Dart templates. The scripts implement regex validation to ensure these inputs conform to expected PascalCase or alphanumeric formats, preventing code injection into the generated files.
Audit Metadata