plugin-transfer

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard pnpm commands (generate, build, test, dev) to facilitate a legitimate plugin migration workflow within the author's monorepo environment. These commands are expected for the skill's primary purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process files from external plugin repositories during the migration process.
  • Ingestion points: The agent reads and copies files such as package.json, README.md, and configuration files from the plugin being migrated (referenced in SKILL.md).
  • Boundary markers: No specific boundary markers or instructions to ignore embedded content are defined for the files being migrated.
  • Capability inventory: The skill possesses capabilities to write files to the local system (test-studio wiring, README updates) and execute shell commands (pnpm build/test).
  • Sanitization: No sanitization or validation of the content within the migrated files is explicitly mentioned.
  • Note: This represents a standard risk surface inherent to plugin migration tasks; no malicious patterns were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:43 PM