plugins
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed to manage the agent's plugin environment using official CLI tools. All mutations are performed through the 'claude plugin' command set, which is the platform's native mechanism for these tasks.
- [SAFE]: The skill implements strict safety protocols for destructive operations. The 'converge' action, which can modify settings and uninstall plugins, requires explicit user confirmation for each change and automatically aborts if it detects an autonomous or remote session environment.
- [SAFE]: Data processing is handled by 'fleet-state.sh', a read-only Bash script that inspects local configuration files (e.g., 'installed_plugins.json', 'settings.json') to detect version drift. The script includes shape validation for internal JSON files to ensure reliability.
- [SAFE]: Network activity is confined to standard marketplace synchronization via the 'claude plugin' CLI. No unauthorized network requests or data exfiltration attempts were identified.
- [SAFE]: The skill adheres to the principle of least privilege, only requesting access to the specific files and tools necessary for its documented purpose. There is no evidence of obfuscation, privilege escalation, or persistence mechanisms.
Audit Metadata