plugin-integration-checker
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides bash scripts intended for execution by the agent to perform directory traversal and search for architectural patterns. These scripts utilize standard system utilities including
dirname,basename,grep, andjq. - [DATA_EXPOSURE]: The skill accesses local project metadata (
plugin.json) and documentation files (commands/andagents/directories) to identify integration points and evaluate the separation of concerns. This access is restricted to the local project workspace. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from external markdown files and JSON metadata to generate architectural reports. While this establishes an ingestion surface for untrusted data, the processing is limited to structural analysis and pattern matching.
- Ingestion points: Reads
plugin.jsonand markdown files located incommands/andagents/directories (SKILL.md). - Boundary markers: The skill does not define specific delimiters for the ingested content but processes it through targeted
grepandjqcommands. - Capability inventory: Utilizes
bash,grep, andjqfor file processing; includes example implementation patterns usingcurlfor local API checks. - Sanitization: Employs
jqfor structured data extraction, which mitigates simple injection risks during metadata parsing.
Audit Metadata