orderly-plugin-add
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch plugin metadata using
orderly-devkit viewand explicitly prioritize following instructions found in theusagePromptorreadmefields provided by the plugin author. - Ingestion points: Output of
orderly-devkit view <pluginId>, specifically theusagePromptandreadmefields. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when processing this external content.
- Capability inventory: The agent has capabilities to execute
grep, modify local source files, and run package installation commands (pnpm install). - Sanitization: No sanitization or validation of the fetched metadata instructions is described.
- [COMMAND_EXECUTION]: The skill uses
grepto search the localsrc/directory forOrderlyAppProviderusage. This is a standard code discovery operation. - [EXTERNAL_DOWNLOADS]: The skill references the use of
npx orderly-devkitandpnpm installfor fetching plugin metadata and managing dependencies. These operations target the vendor's own ecosystem and standard package registries.
Audit Metadata