Skills
Navigate
skills/microck/opendots-microck/plugin-forge/Gen Agent Trust Hub

plugin-forge

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation and modification of plugin manifests using user-supplied metadata that is not sanitized.
  • Ingestion points: CLI arguments in scripts/create_plugin.py (--author-name, --description, --keywords).
  • Boundary markers: Absent; metadata is directly interpolated into JSON and Markdown templates.
  • Capability inventory: Filesystem write operations in scripts/create_plugin.py and scripts/bump_version.py affecting plugin.json, marketplace.json, and README.md files.
  • Sanitization: No validation or filtering is applied to the metadata strings before they are persisted to disk.
  • [COMMAND_EXECUTION]: The skill workflow relies on the execution of local Python scripts (scripts/create_plugin.py and scripts/bump_version.py) to automate filesystem tasks such as directory creation and file updates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 12:59 PM