plugin-forge
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides utility tools for local plugin development and version management.
- [COMMAND_EXECUTION]: Includes Python scripts (
create_plugin.py,bump_version.py) that perform local file system operations such as directory creation and reading/writing JSON manifests. These scripts use standard Python libraries (pathlib,json,argparse) and follow safe path resolution practices without using dangerous shell commands or network operations. - [INDIRECT_PROMPT_INJECTION]: The scaffolding script (
create_plugin.py) represents a standard vulnerability surface as it interpolates user-supplied strings into generated manifest and documentation files. - Ingestion points: CLI arguments passed to
create_plugin.pyincluding--description,--author-name, and--keywords. - Boundary markers: None implemented in the generated README or manifest templates.
- Capability inventory: File system write operations via standard Python I/O.
- Sanitization: No input sanitization is performed on metadata strings before they are written to files.
Audit Metadata