creating-backstage-scaffolder-action
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill exclusively contains educational content, architectural patterns, and code snippets for developing Backstage plugins. No malicious behavior or obfuscation was detected.
- [COMMAND_EXECUTION]: The provided code templates include file system operations using
fs.writeFile. These are correctly scoped to theworkspacePathprovided by the Backstage Scaffolder environment, following the framework's sandboxing best practices. - [DATA_EXFILTRATION]: The examples demonstrate making network requests via
fetchand retrieving user identity throughctx.getInitiatorCredentials(). These operations are documented as legitimate framework capabilities for building external integrations and rely on Backstage's internal authentication and authorization services.
Audit Metadata