optimize-plugin
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python validation script (
validate-plugin.py) located within the environment's plugin root directory to analyze the target plugin's structure and manifest. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-provided plugin files (e.g., manifests, markdown instructions, and scripts) and passes the results to a sub-agent.
- Ingestion points: Reads all files within the target plugin directory, including metadata and component code.
- Boundary markers: None explicitly defined in the prompt passed to the optimization agent.
- Capability inventory: Uses
Bash(python3:*),Skill, andTasktools, enabling file system modification and script execution. - Sanitization: No explicit sanitization of the plugin content is mentioned before processing.
- [DYNAMIC_EXECUTION]: The skill launches an autonomous agent (
plugin-optimizer:plugin-optimizer) to programmatically apply fixes to the plugin's code, structure, and versioning based on the validation report findings.
Audit Metadata