cowork-plugin-customizer
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill employs standard shell commands including
find,grep,zip, andcpto manage plugin files. These are used strictly for their intended purpose: locating source files, identifying placeholders, and packaging the final customized plugin for the user. - [DATA_EXFILTRATION]: The skill instructions direct the agent to query internal organizational sources (Slack, Email, Documents) via Model Context Protocol (MCP) servers. This is a core feature used to pre-fill configuration values automatically, and the data is only used to generate the final plugin and a summary report for the user.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted content from external plugin files and search results. However, the risk is minimal as the agent is instructed to perform specific, structured replacements rather than executing code derived from the input data.
- Ingestion points: Plugin source files (Markdown and JSON) and search results from internal Slack/Document/Email sources.
- Boundary markers: None explicitly defined; the skill uses its internal workflow logic to parse and filter content.
- Capability inventory: File system discovery, reading, regex searching, and archive creation.
- Sanitization: No explicit sanitization or escaping of the ingested content is specified before it is integrated into the final plugin outputs.
Audit Metadata