marketplace-sync

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from plugin documentation to generate marketing metadata, creating a potential surface for indirect instructions.
  • Ingestion points: scripts/sync-marketplace.py reads markdown and JSON files from the plugins directory.
  • Boundary markers: No explicit delimiters are used in the prompt instructions to isolate external content.
  • Capability inventory: The skill allows the agent to read plugin files and write to docs/plugins.json.
  • Sanitization: Text from documentation files is processed without validation or filtering for prompt injection patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:36 PM