check-videocut-updates
Warn
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with the Codex plugin system and the local file system.
- [COMMAND_EXECUTION]: It uses a Node.js one-liner to parse JSON output from a shell command and dynamically determine the installation path of a specific plugin.
- [COMMAND_EXECUTION]: It executes a JavaScript file (
check-plugin-update.cjs) located within the dynamically discovered path of another plugin. This constitutes dynamic loading and execution of code from a computed path. - [EXTERNAL_DOWNLOADS]: The skill is designed to interact with an external marketplace to check for updates and potentially trigger downloads and installations using the
codex plugin marketplace upgradeandcodex plugin addcommands. - [COMMAND_EXECUTION]: Shell variables such as
$marketplaceName,$shownVersion, and$shownImmutableRefare passed as arguments to a Node.js script. If these variables contain unsanitized input, they could potentially lead to command line argument injection.
Audit Metadata