plugin-upgrade
Warn
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: Use of !!js tag in YAML configuration files as shown in references/host-plane-probes.md allows for arbitrary JavaScript execution during the plugin loading process. This mechanism utilizes node:module and node:fs to perform runtime checks.
- [REMOTE_CODE_EXECUTION]: The verify-runtime.mjs script performs end-to-end verification by installing and executing plugin code. This process includes running npm/git lifecycle scripts and booting the DeepSeek Harness environment with the plugin active, which executes arbitrary code with the user's permissions.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by ingesting and analyzing untrusted plugin source code and YAML manifests.
- Ingestion points: scripts/plan-migration.mjs and scripts/verify-runtime.mjs read entire plugin directories.
- Boundary markers: No specific delimiters or "ignore" instructions are placed around analyzed content when presented to the agent.
- Capability inventory: The skill has extensive file writing and subprocess execution capabilities (execFile, spawnSync, writeFileSync).
- Sanitization: The tail function in scripts/verify-runtime.mjs strips ANSI escape codes.
- [DATA_EXFILTRATION]: Deliberately malicious patterns in the legacy-plugin example demonstrate hardcoded paths to user profile directories (~/.dsh/profiles/default) and the creation of local HTTP servers (127.0.0.1:43121). While intended as fixtures for the skill's validator, they constitute risky data exposure patterns.
Audit Metadata