cowork-plugin-builder
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates a build prompt containing Python code snippets for image processing (using the Pillow library) and file packaging (using the standard zipfile library). These generated commands are executed locally if the user chooses to build the package immediately.
- [EXTERNAL_DOWNLOADS]: During the interview process, the skill collects user-provided external URLs for developer information and MCP (Model Context Protocol) endpoints to be included in the plugin manifest.
- [PROMPT_INJECTION]: The skill processes untrusted user input and interpolates it into a build prompt, creating a surface for indirect prompt injection. 1. Ingestion points: User interview answers (names, descriptions, and workflow steps) gathered in Phase 2. 2. Boundary markers: No specific delimiters or instructions to ignore embedded commands are used during template interpolation in Phase 3. 3. Capability inventory: File system writes to the 'output/' directory and execution of generated Python code in Phase 4. 4. Sanitization: While hostname and language tag validation are mentioned, natural language fields lack sanitization against prompt injection patterns.
Audit Metadata