plugin-development
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a meta-documentation guide for plugin development. It includes numerous code examples in JSON, YAML, Bash, SQL, and TypeScript, all of which are consistent with the stated purpose of teaching plugin architecture.
- [COMMAND_EXECUTION]: The file contains Bash script examples, including a security-focused hook script that demonstrates how to intercept and block dangerous commands. A static analysis hit for destructive commands was triggered by a code snippet that explicitly checks for and blocks 'rm -rf /', which is a defensive implementation example rather than a threat.
- [REMOTE_CODE_EXECUTION]: No patterns for remote code execution or unauthorized downloads were found. Examples involving tool use (e.g., SQLite migrations, manifest validation) are provided as local development templates.
- [DATA_EXFILTRATION]: No evidence of data exposure or exfiltration was detected. The guide correctly instructs developers to use standard permissions models and avoid hardcoding sensitive information.
Audit Metadata