developing-claude-plugins
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches official documentation and reference material from Anthropics' GitHub repositories (github.com/anthropics/claude-code and github.com/anthropics/skills) and official documentation at code.claude.com.
- [COMMAND_EXECUTION]: The skill restricts its own Bash tool usage to a specific budget monitoring script (context-budget.sh) located within the plugin root. Provided templates and examples suggest the use of standard development tools such as prettier, eslint, and ts-node via pnpm dlx.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection due to its processing of external documentation and user-managed plugin files.
- Ingestion points: Fetches documentation from GitHub and official websites; reads local plugin configuration and definition files.
- Boundary markers: Includes instructions to wrap external or pasted content in specific <pasted_content> tags to maintain context separation.
- Capability inventory: Uses tools like Write, Edit, and restricted Bash to manage and modify plugin code.
- Sanitization: Employs self-verification checklists and structured templates to guide the safe generation and optimization of plugin elements.
Audit Metadata