feat(scanner): reject unsigned plugin downloads and runtime installers

[seonghobae]

Summary

• Fail closed on unsigned executable fetches in hooks/scripts/commands (claude-plugin-unsigned-executable-download): curl/wget writing a binary then chmod +x or executing it, and installer bootstrap such as curl | python.
• Fail closed on unpinned package URL installs (claude-plugin-unpinned-package-install): pip/npm/cargo install of https:// or git+ URLs.
• A pinned licensed plugin with only echo hi still passes. package.json plus a lockfile without a postinstall download is package_install inventory, not a finding. Ordinary pip install requests and curl healthchecks stay inventory.
• Detector snippets omit secret literals and raw bidi.

Successor of #1137 / #1136 / #1099 TDD item 9. Does not Close #1099, #1137, #1136, #1135, #1134, #1129, #1087, #929, #983, #1106, #1036, #1133, or #998. Does not steal G-06 #1133. Does not reimplement #1036.

Ordinary restack — 2026-09-12

• Exact two-parent head 94d3d7f5b4d7e16a46291f217f9269d88badf8cc, tree 31dc2873576a5e666654ca3af19837477411626a.
• Parents: prior feat(scanner): reject unsigned plugin downloads and runtime installers #1138 bdb380938b33bd9918eafc433ff3081964bd36a4 and current feat(scanner): reject GitHub write tokens and Docker sockets #1137 07fcbcd0764ff12180e64b7258db96505d1db812.
• Three ahead / zero behind feat(scanner): reject GitHub write tokens and Docker sockets #1137; mergeable. The unsigned-download/package-install delta and feat(scanner): reject GitHub write tokens and Docker sockets #1137 network-reference precision regression are both present.
• Exact scoped verification: 70/70 across supply-chain and network-reference precision tests; py_compile and diff check passed.
• No hosted workflow or independent review exists on this custom-base head, so keep Draft.

Test plan

• Original RED then GREEN on tests/test_claude_plugin_supply_chain.py (67 passed)
• Original statement coverage 1150/1150 and docstring coverage 70/70
• Existing gh issue create / docker push inventory-not-finding contract retained
• Current-parent ordinary restack and scoped 70/70
• Exact-head Checks/OpenCode/Strix/CodeQL-verdict on this head
• Keep Draft until current-head gates are GREEN

Relates to #1099. Relates to #1137.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}