feat(scanner): inventory Claude plugin capabilities and undeclared executables

[seonghobae]

Stacking

Successor of Draft #1129 / issue #1099. Targets security/cwl-issue-detector-families (exact base cfd5ae6267dfa026db860c1e8c235b5708dacbbf), not develop and not #998.

Does not Close #1099 or #1129. Does not close #1087, #929, #983, #1106, #1036, or #1133. Does not reimplement #1036 homoglyph/injection/exfil/placeholder detectors — reuse those rule IDs if they fire through the package scanner. Inventory is evidence, not permission.

Unique delta

• Machine-readable capability inventory with deterministic keys: filesystem_read, filesystem_write, process_spawn, shell_execution, package_install, network_egress, browser_profile_access, credential_access, mcp_server_start, mcp_remote_connect, github_read, github_write, github_review, github_merge, github_release, deployment_write, model_provider_access.
• Presence of a capability is not a finding by itself. A pinned licensed plugin with only a declared shell hook may inventory shell_execution / process_spawn and still scan_result=pass.
• Fail closed on undeclared executable surfaces after manifest inventory (TDD 🧹 [Code Health] Remove redundant dictionary fallback for severity counts #10): extra scripts/hidden.py or commands/run.py is claude-plugin-undeclared-executable and appears on the receipt.
• Receipt capability_inventory_sha256 is SHA-256 of the canonical JSON inventory (sorted keys, no secrets). Identical source+policy → identical digest; adding network curl to a declared hook changes the digest.
• Snippets and receipts still omit raw secrets and raw bidi characters.

#1129 remains owner of prior admission rules (floating refs, provider secrets, pipe-to-shell, undeclared hooks already scanned, symlink escape, duplicate JSON, unbounded MCP, missing LICENSE, concealed identity, oversized packages, receipts, LifeOS skip-auth).

Evidence

• focused plugin tests: 29 passed
• python -m scripts.ci.verify_module_coverage --module appguardrail_core/claude_plugin_detector.py --test tests/test_claude_plugin_supply_chain.py: 638/638

Relates to #1099. Relates to #1129.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Non-force restack onto #1129 exact head 24c6dda1c70f86628823086fcc2cff641fbb41df. New successor head 0cd4329cf21aed37831863ad91350d0c39d0b689.

Merged unique #1099 source/ref/path mismatch without replacing this PR's capability-inventory delta. Focused plugin/docs tests 43 passed; claude_plugin_detector.py statement coverage 689/689 after the restack.

Still Draft. Relates to #1099. Does not close #1087, #929, or #983.

[seonghobae]

Successor Draft #1135 (feat/claude-plugin-archive-submodule-1099) is stacked on this PR for issue #1099 TDD item 5 (archive path traversal + nested submodule without admitted identity).

This PR (#1134) remains the capability-inventory owner. #1135 does not take inventory/undeclared-executable/capability_inventory_sha256 work, does not Close #1099/#1134/#1129, and does not steal G-06 #1133 or #998.

[seonghobae]

Non-force restack onto #1129 e53d408 / #998 60cdd3f. New successor head cdf79fb3396bba522eb72d3cad16c6f4ae40ef0b.

Still Draft. Relates to #1099. Does not close #1087, #929, or #983.

[seonghobae]

Non-force restack onto #1129 c5be73c. New successor head 36e8f37bc67392dd04ace4df8dbcdceed371e097. Still Draft.