Skills
skills/edwinhu/workflows/plugin-creator/Gen Agent Trust Hub

plugin-creator

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill configures PostToolUse hooks that execute validation scripts (plugin-validate.py and validate-skill-paths.py) via uv run python3. These scripts are located within the plugin's own directory structure (${CLAUDE_PLUGIN_ROOT}/hooks/), representing standard automated validation after file edits.
  • [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !cat command to dynamically inject the contents of local documentation files (creator-anti-patterns.md and enforcement-checklist.md) into the system prompt at load time. These commands use the ${CLAUDE_SKILL_DIR} environment variable to resolve paths to reference files bundled with the skill, which is a legitimate use of dynamic injection for context management.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 06:29 AM
Security Audit — agent-trust-hub — plugin-creator