Set Flash plugin minimum version to currently installed version while evaluating Xprotect.meta.plist changes. Note $3 entries for easy use in a payload-free package.

gistfile1.sh

#!/bin/bash

function version { echo "$@" | awk -F. '{ printf("%d.%d.%d.%d\n", $1,$2,$3,$4); }'; }

if [[ -e "$3/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist" ]]; then

	CURRENT_FLASH_BUILD=`/usr/libexec/PlistBuddy -c "print :CFBundleShortVersionString" "$3/Library/Internet Plug-Ins/Flash Player.plugin/Contents/Info.plist"`
	XPROTECT_FLASH_BUILD=`/usr/libexec/PlistBuddy -c "print :PlugInBlacklist:10:'com.macromedia.Flash Player.plugin':MinimumPlugInBundleVersion" "$3/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist"`

	if [[ $(version ${CURRENT_FLASH_BUILD}) < $(version ${XPROTECT_FLASH_BUILD}) ]]; then
		logger "Current Flash version (${CURRENT_FLASH_BUILD}) is less than the minimum build required by Xprotect (${XPROTECT_FLASH_BUILD}), reenabling."
		/usr/libexec/PlistBuddy -c "set :PlugInBlacklist:10:'com.macromedia.Flash Player.plugin':MinimumPlugInBundleVersion ${CURRENT_FLASH_BUILD}" "$3/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist"
	else
		logger "Current Flash version is ${CURRENT_FLASH_BUILD} and Xprotect minimum build is ${XPROTECT_FLASH_BUILD}, nothing to do here."
	fi
else
	logger "Xprotect not found, skipping."
fi

Cleaned up extraneous quotes in PlistBuddy set command.