plugin-structure
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely educational, providing guidance on plugin directory layout, manifest configuration, and component organization. No malicious patterns such as prompt injection, data exfiltration, or obfuscation were detected.
- [COMMAND_EXECUTION]: While the documentation provides examples of shell scripts (e.g.,
validate-commit.sh) and hook configurations that execute commands, these are clearly labeled as developer examples. The skill itself does not perform any unauthorized or dangerous command execution. - [CREDENTIALS_UNSAFE]: The skill mentions environment variable placeholders like
${GITHUB_TOKEN}and${API_KEY}in example configurations. These are standard practices for managing secrets in the target platform and do not involve hardcoded credentials.
Audit Metadata