plugin-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local repository (instructions and git status) during the discovery phase. This data is used to inform the workflow planning, providing a surface for malicious instructions to influence the agent's selection or interpretation of the plugin's state. \n
- Ingestion points: The discovery step described in SKILL.md reads repository instructions and Git status. \n
- Boundary markers: SKILL.md explicitly defines three confirmation boundaries: repository writes, dependency/runtime execution, and external publication. \n
- Capability inventory: The skill coordinates owners ($plugin-upgrade, $plugin-write, $plugin-test, etc.) that possess file-system access, command execution, and network capabilities. \n
- Sanitization: Input is validated via a deterministic planner script (scripts/plan-workflow.mjs) against a strict JSON schema. \n- [COMMAND_EXECUTION]: The skill executes its own Node.js script to render menus and validate workflow plans. \n
- Evidence: SKILL.md directs the agent to run
node <plugin-workflow-skill>/scripts/plan-workflow.mjswith various flags and user-supplied arguments. \n - Mitigation: The script performs rigorous validation of all command-line arguments against a hardcoded enum list and the referenced JSON schema, preventing arbitrary command injection.
Audit Metadata