plugin-authoring
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: Provides instructions for creating and loading dynamic JavaScript/TypeScript modules as plugins. It explains the registration of function hooks and the isolated execution environment where modules run.
- [COMMAND_EXECUTION]: Documents the
$.process.runengine interface, which allows plugins to execute host commands using argument vectors. - [INDIRECT_PROMPT_INJECTION]: Describes the architecture for processing external event data (such as tool inputs and user prompts). It identifies the ingestion points for untrusted data and the corresponding engine capabilities (filesystem, network, process execution) available to the hooks, serving as documentation of the platform's extensibility surface.
Audit Metadata