publish-moviepilot-plugin
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/publish_plugin.pyusingexecute_commandto perform GitHub operations, repository management, and local file comparison. - [EXTERNAL_DOWNLOADS]: Synchronizes plugin files and metadata from GitHub repositories via the GitHub Contents API during pull, push, and preview operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes plugin metadata (package.json) and file content from external GitHub repositories, creating a surface for indirect instructions to enter the agent context.
- Ingestion points: Downloads file content and metadata from GitHub repositories within
scripts/publish_plugin.py. - Boundary markers: Not explicitly mentioned in instructions, though the skill primarily treats the data as files to be synchronized rather than instructions to be executed.
- Capability inventory: The skill has access to
execute_command,write_file, andmoviepilot_apifor local system modifications. - Sanitization: The script uses JSON parsing for metadata validation and handles file content as binary data.
Audit Metadata