plugin-remover — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plugin-remover (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill orchestrates the safe, interactive removal of plugins from the local agent environment and updates the canonical tracking registries (plugin-sources.json and skills-lock.json).
By relying on the plugin_remove.py TUI, this skill ensures that no ghost files, orphaned symlinks, or stale hook registrations remain after a plugin is uninstalled.
plugin_remove.py. Do NOT attempt to manually rm -rf plugin directories directly from .agents/..agents/skills, .agents/workflows, .claude/, .gemini/, etc.skills-lock.json and plugin-sources.json to keep auto-update loops synchronized.Whenever the user asks to "remove a plugin", "uninstall a skill", or "delete a plugin", guide them to use the interactive TUI or run headless via flags.
# Interactive TUI — lists all plugins tracked in plugin-sources.json
uvx --from git+https://github.com/richfrem/agent-plugins-skills plugin-remove
# Headless: remove a specific plugin without prompting
uvx --from git+https://github.com/richfrem/agent-plugins-skills plugin-remove --plugins agent-loops --yes
# Headless: remove all tracked plugins
uvx --from git+https://github.com/richfrem/agent-plugins-skills plugin-remove --all --yes# Interactive TUI from local clone
uvx --from . plugin-remove
# Headless: remove a specific plugin
uvx --from . plugin-remove --plugins agent-loops --yes
# Or run the underlying Python script directly:
python plugins/plugin-manager/scripts/plugin_remove.py
python plugins/plugin-manager/scripts/plugin_remove.py --plugins agent-loops --yes
python plugins/plugin-manager/scripts/plugin_remove.py --dry-runFor each selected plugin, the uninstaller:
.agents/skills/, .agents/workflows/, .agents/agents/, .agents/hooks/, .claude/, .gemini/, etc.plugin-sources.json (auto-update registry).skills-lock.json.plugin-sources.json must exist and contain tracked plugins. Run plugin-add first.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.