verify-bundle-sync
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill executes local, read-only comparisons using standard CLI tools like
jqanddiffto ensure project directory integrity. - [DATA_EXFILTRATION]: The skill reads from
.claude-plugin/marketplace.jsonand accesses theskills/andplugins/directories to perform its checks. This data is not transmitted externally and is handled within the local project context. - [PROMPT_INJECTION]: The skill uses skill names retrieved from the local configuration to build paths for comparison. This represents an indirect injection surface, but the risk is assessed as safe given the tool's limited read-only capabilities and the local origin of the data.
- Ingestion points:
.claude-plugin/marketplace.json(referenced in Step 1). - Boundary markers: None present for the ingested configuration data.
- Capability inventory: Utilizes
jq,diff, andtestin Step 1 and 2 for local file system verification. - Sanitization: No explicit sanitization of skill names before path construction.
Audit Metadata