creating-backstage-catalog-provider
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill consists of technical documentation and code templates for building Backstage backend modules. No malicious code, obfuscation, or unauthorized access patterns were detected.
- [EXTERNAL_DOWNLOADS]: The skill references standard dependencies from the '@backstage' ecosystem, which are well-known libraries for the Backstage framework. These are used for development purposes and do not represent a security risk.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting data from external sources into the Backstage catalog.
- Ingestion points: Data is ingested from external URLs via 'fetch' calls in 'references/entity-provider.md'.
- Boundary markers: The provided code templates do not include explicit boundary markers or instructions to treat external data as untrusted.
- Capability inventory: The generated modules perform network requests and update the internal catalog database.
- Sanitization: The templates focus on mapping data fields and do not include content sanitization logic.
Audit Metadata