skills/openai/codex/plugin-creator/Gen Agent Trust Hub

plugin-creator

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Local Command Execution: The skill instructs the agent to execute a bundled Python script (create_basic_plugin.py) to perform scaffolding tasks. This is a common pattern for automation tools but requires the user to trust the script's source code.
  • File System Operations: The Python script creates directories and writes JSON configuration files (plugin.json and marketplace.json) to the local file system. It uses standard path resolution and handles user-provided paths for destination directories.
  • Input Sanitization: The script includes a normalization process for plugin names, using regular expressions to ensure names only contain lowercase alphanumeric characters and hyphens. This serves as a security best practice by preventing path traversal or special character injection in filenames.
  • Placeholder Content: The generated configuration files use clear [TODO: ...] placeholders, ensuring that the skill does not inadvertently publish or use unverified data without human intervention.
  • Vendor Integration: The skill and its references utilize domains and naming conventions associated with the author's infrastructure, which is consistent with its role as a development tool for that ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 03:34 PM
Security Audit — agent-trust-hub — plugin-creator