plugins-management
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule inscripts/prepare_submission.pyto interact with local development tools such asgitandgh. This is used to automate metadata gathering (e.g., commit SHA, repository URL) for plugin submission. The commands are executed using argument lists (avoiding shell interpolation) and are limited to the skill's stated purpose of plugin management.- [SAFE]: The skill implements security best practices by including a validation script (scripts/validate_plugin.py) and requiring explicit user confirmation via theAskUserQuestiontool before performing any uninstallation or file deletion operations.- [SAFE]: Input validation is present in the initialization scripts (e.g.,scripts/init_plugin.py) to ensure plugin names follow a strict kebab-case alphanumeric format, preventing potential path traversal or command injection via malformed names.
Audit Metadata