manage-marketplace

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Documents commands for adding marketplaces and installing plugins from external sources. Examples include GitHub repositories, GitLab repositories, and direct URLs to marketplace.json files. The example ci@lichens-ai-dev-tools refers to a vendor-owned resource.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a system that ingests untrusted data from external marketplaces which could influence agent behavior. Ingestion points: External marketplace.json files and plugin metadata fetched via claude plugin marketplace add and claude plugin install (SKILL.md). Boundary markers: None explicitly defined in the reference instructions for delimiting untrusted data content. Capability inventory: The skill facilitates the installation and enabling of plugins, which are executable extensions that can perform various operations in the agent environment. Sanitization: Relies on the claude plugin validate command and the underlying platform's validation of plugin schemas.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 04:07 PM