nushell-plugin-builder
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill references and includes configuration examples for the
nushellWithNix flake from an unverified GitHub repository (YPares/nushellWith). This flake is used for environment isolation and plugin testing; as an external dependency from an untrusted source, it poses a risk of remote code execution during the build or test process. - [COMMAND_EXECUTION] (LOW): The instructions require the user to execute local commands including
cargo build,cargo install, andplugin add. These are standard development procedures for Nushell plugins but involve local execution of software built from the provided templates. - [DATA_EXFILTRATION] (INFO): The documentation provides examples of making external HTTP requests using the
reqwestcrate. While functional for plugin development, this highlights a potential exfiltration surface for any custom plugins developed using these patterns. - [DYNAMIC_EXECUTION] (INFO): The skill documents the
engine.evalAPI, which allows plugins to evaluate Nushell code at runtime. Developers must be cautious to sanitize inputs to this API to prevent internal command injection within the Nushell environment.
Audit Metadata