plugin-forge
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard development automation and reference documentation for scaffolding plugin structures. The Python scripts perform local file system operations to manage manifests and directories as expected for a development utility.
- [INDIRECT_PROMPT_INJECTION]: The automation scripts (
create_plugin.py,bump_version.py) ingest user-supplied metadata and interpolate it into file paths and JSON manifest files. - Ingestion points: Command-line arguments in
scripts/create_plugin.pyandscripts/bump_version.py(plugin name, author, description). - Boundary markers: None implemented for the generated files.
- Capability inventory: Local file system write access via
pathlibandjson.dumpin both scripts. - Sanitization: No input validation or path sanitization is performed on the plugin name, which is standard for local scaffolding tools but technically allows writing files to computed paths.
Audit Metadata