plugin-structure

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • Command Execution: The skill provides instructions and examples for executing local scripts (Bash, Python, Node.js) through plugin hooks and MCP server definitions.
  • Evidence: SKILL.md and examples/advanced-plugin.md contain configurations for executing scripts located within the plugin's directory.
  • Dynamic Module Loading: The documentation illustrates loading library modules using computed paths relative to the plugin root environment variable.
  • Evidence: examples/advanced-plugin.md shows require statements using ${CLAUDE_PLUGIN_ROOT} to access shared utilities.
  • Environment Variable Usage: The examples demonstrate the use of environment variables to manage sensitive configuration data and credentials.
  • Evidence: .mcp.json examples in examples/advanced-plugin.md use variables like ${GITHUB_TOKEN} and ${API_KEY}.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 11:07 PM
Security Audit — agent-trust-hub — plugin-structure