plugin-script-architecture
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a 'knowledge' mode resource containing only documentation and standards, with no executable code or scripts.
- [SAFE]: Explicitly prohibits third-party Python dependencies in marketplace scripts, establishing a secure baseline that avoids external supply chain vulnerabilities.
- [REMOTE_CODE_EXECUTION]: Outlines patterns for dynamic module resolution via 'importlib' for local internal helpers, which is a documented architectural feature of the system.
- [COMMAND_EXECUTION]: Provides guidelines for the appropriate use of 'subprocess.run' when interacting with external tools like Git, Maven, and NPM.
- [DATA_EXFILTRATION]: Describes standard procedures for accessing local project configuration data within the '.plan' directory and 'marshal.json' files.
Audit Metadata