plugin-forge

Pass

Audited by Gen Agent Trust Hub on Feb 15, 2026

Risk Level: LOWCOMMAND_EXECUTION
Full Analysis
  • COMMAND_EXECUTION (LOW): The scripts create_plugin.py and bump_version.py execute file system operations based on user-provided CLI arguments. While standard for developer tools, they lack strict path validation on input parameters like plugin_name.
  • PROMPT_INJECTION (SAFE): No patterns of instruction override or safety bypass were detected in the skill instructions or markdown documentation.
  • DATA_EXFILTRATION (SAFE): No unauthorized file access or network communication was found; operations are limited to the user-specified project directories.
Audit Metadata
Risk Level
LOW
Analyzed
Feb 15, 2026, 08:24 PM