Skip to content

feat(scanner): reject plugin archive traversal and unadmitted submodules #1135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
seonghobae wants to merge 4 commits into
base: feat/claude-plugin-capability-inventory-1099
Choose a base branch
from
Draft

feat(scanner): reject plugin archive traversal and unadmitted submodules #1135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a5636ec
test(scanner): require archive traversal and admitted submodule identity
seonghobae Sep 7, 2026
81e83f4
feat(scanner): reject plugin archive traversal and unadmitted submodules
seonghobae Sep 7, 2026
68a4c95
Merge commit 'cdf79fb3396bba522eb72d3cad16c6f4ae40ef0b' into feat/cla…
seonghobae Sep 7, 2026
ef28b05
Merge commit '36e8f37bc67392dd04ace4df8dbcdceed371e097' into feat/cla…
seonghobae Sep 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions CHANGELOG.d/1099-claude-plugin-supply-chain.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@

- Scan Claude plugin marketplace/package manifests as hostile supply-chain
artifacts: floating Git refs, provider API keys, `curl|sh` installers,
undeclared hook/script surfaces, symlink escapes, duplicate JSON members,
unbounded MCP servers, missing LICENSE evidence, concealed bidi/control
identity, oversized package trees, and marketplace/artifact source mismatch.
undeclared hook/script surfaces, symlink escapes, archive path traversal,
nested gitmodules/gitlinks without a recursively admitted SHA, duplicate
JSON members, unbounded MCP servers, missing LICENSE evidence, concealed
bidi/control identity, oversized package trees, and marketplace/artifact
source mismatch.
A machine-readable capability inventory records filesystem, process, MCP,
GitHub, deploy, and provider presence as evidence, not permission; the
receipt binds `capability_inventory_sha256` over canonical JSON without
Expand Down
Loading