sync-plugin-cache

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to execute the system rsync utility with the -a and --delete flags. This mirrors directory contents between build directories and the local plugin cache. The arguments are passed as a list, which is a safe practice against shell injection.
  • [COMMAND_EXECUTION]: The skill instructs the agent to run local Python scripts (sync.py and list_bundles_and_versions.py) that perform synchronization logic, including verifying file integrity via git command-line tools.
  • [COMMAND_EXECUTION]: The sync.py script dynamically adjusts sys.path to import local modules from the repository, facilitating the use of shared code within the project monorepo structure.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 07:12 AM
Security Audit — agent-trust-hub — sync-plugin-cache