nushell-plugin-builder
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates and examples for building tools that process external data streams, creating an ingestion surface for untrusted content.
- Ingestion points: The
inputparameters inPluginCommandimplementations (found inSKILL.mdandreferences/examples.md) receive data directly from the Nushell engine. - Boundary markers: The skill relies on Nushell's internal MsgPack or JSON serialization protocol to manage data boundaries between the shell and the plugin process.
- Capability inventory: Examples demonstrate powerful capabilities including directory reading (
std::fs::read_dir), network requests (reqwest), and dynamic expression evaluation (engine.eval). - Sanitization: The instructions emphasize the use of
LabeledErrorfor user feedback and structuredValuetypes for data handling, though explicit sanitization for dynamic evaluation is not detailed in the examples. - [DYNAMIC_EXECUTION]: The skill includes mechanisms for generating and evaluating code at runtime.
- Template Generation: The
scripts/init_plugin.pyscript performs runtime generation of source code and configuration files by applying string replacements to a project template. - Expression Evaluation: Documentation in
references/advanced-features.mdprovides examples for using theengine.evalmethod to execute Nushell expressions dynamically. - [EXTERNAL_DOWNLOADS]: The skill references external repositories for development and testing tools.
- Vendor Resource: References the author's
nushellWithGitHub repository for building reproducible testing environments. - Community Resources: Links to official Nushell community repositories, including
plugin-examplesandawesome-nuon GitHub.
Audit Metadata