plugin-transfer
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard
pnpmcommands (generate,build,test,dev) to facilitate a legitimate plugin migration workflow within the author's monorepo environment. These commands are expected for the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process files from external plugin repositories during the migration process.
- Ingestion points: The agent reads and copies files such as
package.json,README.md, and configuration files from the plugin being migrated (referenced inSKILL.md). - Boundary markers: No specific boundary markers or instructions to ignore embedded content are defined for the files being migrated.
- Capability inventory: The skill possesses capabilities to write files to the local system (test-studio wiring, README updates) and execute shell commands (
pnpm build/test). - Sanitization: No sanitization or validation of the content within the migrated files is explicitly mentioned.
- Note: This represents a standard risk surface inherent to plugin migration tasks; no malicious patterns were detected.
Audit Metadata