cordon-install
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent and user on how to install a plugin using platform-native commands (
/plugin marketplace add ilyautov/cordonand/plugin install cordon@cordon). - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the Cordon plugin from the author's repository via the platform's marketplace.
- [DYNAMIC_EXECUTION]: The verification section contains a shell script that uses
node -eto dynamically calculate the installation path of the plugin by reading the platform's configuration file. It then executes the resulting path (node "$CORDON" doctor) to run diagnostics. This is a standard functional pattern for verifying plugin installations in a versioned environment. - [DATA_EXPOSURE]: The diagnostic script reads
~/.claude/plugins/installed_plugins.json, which is a platform-specific configuration file used to manage and locate installed extensions. This access is limited to resolving the plugin's path for verification purposes.
Audit Metadata