plugin-marketplace-setup

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a documentation and configuration guide for creating plugin marketplaces. It describes how to structure manifests for various agents (Cursor, Claude, Codex, Zed) and provides templates for configuration files like plugin.json and marketplace.json.- [COMMAND_EXECUTION]: The skill mentions common development commands such as npx skills add, pnpm run validate, and git clone. These are standard tools for the described workflow and do not involve unauthorized or hidden execution.- [EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted development resources, including GitHub repositories for vercel-labs and the author's own project arenukvern/skill_steward. These are documented as part of the intended installation and management workflows for agent plugins.- [DYNAMIC_EXECUTION]: A Dart script skeleton is provided in references/local-copy-pattern.md. This script is designed to be used by developers as a template for automating the copying of files into local plugin directories. It performs standard file system operations (reading, writing, and creating directories) based on explicit user-defined paths. It does not perform any unsafe operations like eval or remote script execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 10:35 AM
Security Audit — agent-trust-hub — plugin-marketplace-setup