plugin-search-and-use
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to search for, read, and follow instructions from external SKILL.md files found in local directories. This creates a surface for indirect prompt injection where a maliciously crafted plugin file could override agent behavior.
- Ingestion points: Reads SKILL.md, plugin.json, and GEMINI.md from directories within skills/use-claude-plugin/knowledge-work-plugins or user-added directories.
- Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are mandated when interpolating these instructions into the agent's context.
- Capability inventory: The skill allows file reading, instruction following, and execution of shell commands (hooks).
- Sanitization: No sanitization or validation of the content of the discovered skill files is performed before the agent adopts their instructions.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to manually execute shell commands defined in hooks.json files found within plugin directories (e.g., npm run lint). This allows for the execution of arbitrary code defined in data files.
- [COMMAND_EXECUTION]: Similar to the dynamic execution finding, the reliance on shell commands from external configuration files (hooks.json) poses a risk of executing unverified commands if the plugin source is untrusted.
Audit Metadata