plugin-syncer
Warn
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONNO_CODE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill is designed to sequentially fetch, install, and update plugins from designated GitHub sources. This capability creates a pathway for arbitrary remote code to be executed within the agent's environment.
- [COMMAND_EXECUTION]: Instructions direct the agent to execute a local Python script (
scripts/sync_with_inventory.py) using the Bash tool to modify the execution environment and manage software artifacts. - [EXTERNAL_DOWNLOADS]: The skill explicitly states it reinstalls skills and plugins from GitHub, performing external network operations to retrieve executable content.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing an external inventory file (
plugin-sources.json) to drive its installation logic. 1. Ingestion points: The skill reads fromplugin-sources.jsonto determine its actions. 2. Boundary markers: No delimiters or 'ignore' instructions are present to prevent the agent from following instructions embedded in the inventory data. 3. Capability inventory: The skill has access to Bash execution and Write permissions for file system cleanup. 4. Sanitization: There is no evidence of integrity validation or source sanitization for the content fetched from GitHub. - [NO_CODE]: The primary execution logic for the synchronization process resides in
scripts/sync_with_inventory.py, which is missing from the provided file set, making a complete verification of its safety protocols impossible.
Audit Metadata