check-videocut-updates

Warn

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with the Codex plugin system and the local file system.
  • [COMMAND_EXECUTION]: It uses a Node.js one-liner to parse JSON output from a shell command and dynamically determine the installation path of a specific plugin.
  • [COMMAND_EXECUTION]: It executes a JavaScript file (check-plugin-update.cjs) located within the dynamically discovered path of another plugin. This constitutes dynamic loading and execution of code from a computed path.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to interact with an external marketplace to check for updates and potentially trigger downloads and installations using the codex plugin marketplace upgrade and codex plugin add commands.
  • [COMMAND_EXECUTION]: Shell variables such as $marketplaceName, $shownVersion, and $shownImmutableRef are passed as arguments to a Node.js script. If these variables contain unsanitized input, they could potentially lead to command line argument injection.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 24, 2026, 09:50 AM
Security Audit — agent-trust-hub — check-videocut-updates