plugin-authoring

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: Provides instructions for creating and loading dynamic JavaScript/TypeScript modules as plugins. It explains the registration of function hooks and the isolated execution environment where modules run.
  • [COMMAND_EXECUTION]: Documents the $.process.run engine interface, which allows plugins to execute host commands using argument vectors.
  • [INDIRECT_PROMPT_INJECTION]: Describes the architecture for processing external event data (such as tool inputs and user prompts). It identifies the ingestion points for untrusted data and the corresponding engine capabilities (filesystem, network, process execution) available to the hooks, serving as documentation of the platform's extensibility surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 11:30 PM
Security Audit — agent-trust-hub — plugin-authoring