nushell-plugin-builder

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides templates and examples for building tools that process external data streams, creating an ingestion surface for untrusted content.
  • Ingestion points: The input parameters in PluginCommand implementations (found in SKILL.md and references/examples.md) receive data directly from the Nushell engine.
  • Boundary markers: The skill relies on Nushell's internal MsgPack or JSON serialization protocol to manage data boundaries between the shell and the plugin process.
  • Capability inventory: Examples demonstrate powerful capabilities including directory reading (std::fs::read_dir), network requests (reqwest), and dynamic expression evaluation (engine.eval).
  • Sanitization: The instructions emphasize the use of LabeledError for user feedback and structured Value types for data handling, though explicit sanitization for dynamic evaluation is not detailed in the examples.
  • [DYNAMIC_EXECUTION]: The skill includes mechanisms for generating and evaluating code at runtime.
  • Template Generation: The scripts/init_plugin.py script performs runtime generation of source code and configuration files by applying string replacements to a project template.
  • Expression Evaluation: Documentation in references/advanced-features.md provides examples for using the engine.eval method to execute Nushell expressions dynamically.
  • [EXTERNAL_DOWNLOADS]: The skill references external repositories for development and testing tools.
  • Vendor Resource: References the author's nushellWith GitHub repository for building reproducible testing environments.
  • Community Resources: Links to official Nushell community repositories, including plugin-examples and awesome-nu on GitHub.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 12:04 PM