plugin-creator
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Local Command Execution: The skill instructs the agent to execute a bundled Python script (
create_basic_plugin.py) to perform scaffolding tasks. This is a common pattern for automation tools but requires the user to trust the script's source code. - File System Operations: The Python script creates directories and writes JSON configuration files (
plugin.jsonandmarketplace.json) to the local file system. It uses standard path resolution and handles user-provided paths for destination directories. - Input Sanitization: The script includes a normalization process for plugin names, using regular expressions to ensure names only contain lowercase alphanumeric characters and hyphens. This serves as a security best practice by preventing path traversal or special character injection in filenames.
- Placeholder Content: The generated configuration files use clear
[TODO: ...]placeholders, ensuring that the skill does not inadvertently publish or use unverified data without human intervention. - Vendor Integration: The skill and its references utilize domains and naming conventions associated with the author's infrastructure, which is consistent with its role as a development tool for that ecosystem.
Audit Metadata