pluginstaller
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from arbitrary GitHub repositories provided by the user at runtime (SKILL.md, Step 1).
- [COMMAND_EXECUTION]: The skill performs file system operations, including copying entire directories and writing to JSON configuration files in both the current working directory and the user's home directory (~/.codex/plugins/). It also specifies a workflow step to restart the Codex application, which involves process management (SKILL.md, Steps 4, 6, and 9).
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external repositories, specifically the
.codex-plugin/plugin.jsonfile. This content is used to define installation paths and metadata, creating a vulnerability surface where a malicious repository could attempt to manipulate file paths or inject instructions into the marketplace configuration. - Ingestion points: Cloned GitHub repository content, specifically
.codex-plugin/plugin.json(SKILL.md). - Boundary markers: None identified; the agent is instructed to validate structure but not to ignore embedded instructions.
- Capability inventory: File system read/write in $CWD and home directory, network access (git clone), and application restart capabilities.
- Sanitization: The skill validates the presence of specific JSON keys but does not perform security sanitization on the values provided by the external source.
Audit Metadata