plugin-conventions

Warn

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute uv tool run "claudelint@0.3.3", which involves downloading and running code from a public package registry at runtime. As the package is not from a recognized trusted organization, it represents an unverifiable external dependency.\n- [COMMAND_EXECUTION]: The instructions require the agent to run multiple local commands, including node plugins/plugin-validator/test.js, make, and bats, providing a vector for executing local scripts and build tools within the workspace.\n- [EXTERNAL_DOWNLOADS]: The validation workflow utilizes uv tool run, which facilitates the automatic downloading of external software tools into the execution environment during the validation phase.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 15, 2026, 04:01 AM