creating-backstage-plugin
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions and identifiers to scaffold new project files. This input is then interpolated into shell commands, creating a potential attack surface for command injection or directory traversal if an attacker provides a crafted plugin ID.
- Ingestion points: User input captured in
SKILL.md(Step 1: Capture intent) andreferences/templates.md(Step 8-9). - Boundary markers: The skill mentions a requirement for kebab-case identifiers, which serves as a weak boundary, but lacks explicit instructions to sanitize or validate the input against shell-specific metacharacters.
- Capability inventory: The skill executes
yarn new,ls, andyarn installvia the shell (Step 4 and 5 inSKILL.md). - Sanitization: There is no explicit sanitization step described to prevent the user-supplied
<id>from containing shell injection payloads like;or&&. - [COMMAND_EXECUTION]: The skill involves the execution of shell commands (
yarn new --select <template> --option pluginId=<id>) where the<id>is derived from user input. While intended for scaffolding, this mechanism can be exploited if the agent executes the string as a raw shell command without escaping.
Audit Metadata