create-cowork-plugin
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Standard Command Execution: The skill employs standard system utilities such as
zipandcpto package the completed plugin into a.pluginarchive and move it to the local outputs directory. These operations are essential for the skill's primary function of delivering a ready-to-use plugin file. - Secure Configuration Patterns: The documentation encourages the use of
${VAR_NAME}placeholders for MCP server configurations and intra-plugin paths. This approach is a recognized best practice for avoiding hardcoded secrets and maintaining portability across different environments. - Validation Procedures: The workflow includes a structural verification step, recommending the use of
claude plugin validateor manual checks to ensure theplugin.jsonmanifest and directory layout are correct before final packaging.
Audit Metadata