plugin-structure
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely informational, serving as a technical guide and reference for developers building plugins. It does not contain any executable scripts that run automatically or perform system operations.
- [SAFE]: Example configurations for manifests (
plugin.json) and MCP servers (.mcp.json) correctly use environment variable placeholders (e.g.,${GITHUB_TOKEN},${AWS_REGION}) for sensitive data, adhering to secure development practices. - [SAFE]: The documentation explicitly encourages security measures, such as the inclusion of hooks for secret scanning and permission validation, as well as advice against committing secrets to version control.
- [SAFE]: No prompt injection, obfuscation, or persistence mechanisms were detected in the instructions or examples.
Audit Metadata