p-plugin-installer
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
git cloneandgit pullto fetch plugin content from remote repositories (e.g., GitHub). This is the primary function of the skill but involves bringing external, unverified code into the local environment. - [COMMAND_EXECUTION]: To repair installation states, the skill executes various shell commands including
git,codex plugin, and PowerShell commands for JSON manipulation. It specifically targets Windows environments where it attempts to bypassEPERMissues by manually managing directory structures. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It directs the agent to read and parse manifest files (
.claude-plugin/marketplace.json,plugin.json) from untrusted external repositories to determine configuration parameters. An attacker could embed malicious instructions in these manifests to influence the agent's behavior during the repair process. - Ingestion points: External repository manifests (e.g.,
marketplace.json) accessed viagit(SKILL.md). - Boundary markers: Absent. No instructions are provided to the agent to ignore or isolate instructions found within the downloaded manifests.
- Capability inventory: File system writes (configuration files), command execution (
git,codex), and state modification (SKILL.md). - Sanitization: Absent. The skill encourages direct parsing and application of values found in external JSON files.
Audit Metadata