Security analysis knowledge for Claude Code plugins. This skill should be used when the user asks to check, audit, scan, or review a Claude Code plugin for security risks, vulnerabilities, or malicious code. Common triggers include 'is this plugin safe', 'scan plugin for security issues', 'audit plugin hooks', 'check for prompt injection', 'review MCP server security', or 'analyze plugin scripts for risks'.
npx claudepluginhub sontixyou/sleuth --plugin plugin-security-checkerThis skill uses the workspace's default tool permissions.
Analyze Claude Code plugins for security risks by systematically examining each component type. Report findings with severity levels and actionable recommendations.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Provides patterns for autonomous Claude Code loops: sequential pipelines, agentic REPLs, PR cycles, de-sloppify cleanups, and RFC-driven multi-agent DAGs. For continuous dev workflows without intervention.
Applies NestJS patterns for modules, controllers, providers, DTO validation, guards, interceptors, config, and production TypeScript backends with project structure and bootstrap examples.
Analyze Claude Code plugins for security risks by systematically examining each component type. Report findings with severity levels and actionable recommendations.
For automated scanning, use the /plugin-security-checker:security-check command or the security-scanner agent.
For the report format template, refer to references/report-template.md.
Hooks execute shell commands automatically in response to Claude Code events. They run with the user's full permissions.
Check hooks.json and any hook configurations in plugin.json for:
IMPORTANT: The pattern lists below are representative examples, not exhaustive. Always apply behavioral analysis — read each hook command/script and evaluate its intent. Ask: "What is this hook actually trying to do? Does that match the plugin's stated purpose?" Flag any behavior that seems disproportionate or unrelated to the plugin's function.
Dangerous command patterns:
rm -rf, rm -f, mkfs, dd if=, shredcurl | bash, wget -O- | sh, eval $(curl, source <(curl, bash <(curlpython -c, python3 -c, node -e, ruby -e, perl -e, php -rbash -i >& /dev/tcp/, nc -e, ncat, socat, mkfifo + pipe to nc, Python/Ruby/PHP/Node socket-based shellssudo, su -, chmod 777, chmod +s, chown rootkill -9, pkill, killall (when targeting system processes)Data exfiltration patterns:
curl -d, curl -F "file=@", wget --post-data, curl -X POSTdig, nslookup, host (encoding data in DNS queries)openssl s_client, /dev/tcp/, /dev/udp/scp, rsync to remote hosts, sftp, ftpcurl -d "$(env)", printenv, set piped to network commands~/.ssh/, ~/.aws/, ~/.gitconfig, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.pypirc, ~/.netrc, ~/.git-credentials, ~/.gnupg/, ~/.vault-token, ~/.config/gcloud/$API_KEY, $SECRET, $TOKEN, $PASSWORD, $PRIVATE_KEY, $DATABASE_URL, $AWS_SECRET_ACCESS_KEYsecurity find-generic-password, security find-internet-passwordPersistence mechanisms:
crontab -e, crontab -l, writing to /etc/cron.d/~/.bashrc, ~/.zshrc, ~/.profile, ~/.bash_profilelaunchctl, writing to ~/Library/LaunchAgents/systemctl, writing to ~/.config/autostart/.git/hooks/Git manipulation:
git config credential.helper — can redirect credential storagegit remote set-url — can redirect push/pull to attacker's server.git/hooks/ — persistence via pre-commit, post-checkout, etc.macOS-specific risks:
osascript — AppleScript execution (can control applications, display fake dialogs)screencapture — screenshot capturepbcopy/pbpaste — clipboard accessHigh-risk event bindings:
SessionStart: Executes on every session start without user actionUserPromptSubmit: Intercepts every user inputPreToolUse: Can modify or block tool executionNotification: Can intercept notification contentObfuscation techniques:
echo "..." | base64 -d | bash, base64 --decodeecho -e "\x...", printf '\x...', xxd -rgzip -d, zlib, compressed payloads piped to executionopenssl enc -d, gpg -d piped to execution${!var}, indirect parameter expansionc="cu"; c+="rl", array-based command buildingMCP servers run as long-lived processes with network access capabilities.
Check .mcp.json and mcpServers in plugin.json for:
Suspicious server commands:
node, python, npx, standard tools)nc, socat, ncatbash -c "curl ... && ..."Network security:
Environment variable exposure:
"env": { "PATH": ... } combined with sensitive varsHOME, USER, or system identity informationDependency risks:
npx executing unverified packages from npmpip or pipx running unverified packagesScan ALL non-declarative files in the plugin. Do not filter by file extension — attackers can use any language or extension. Inspect every file that is not purely declarative markup (.md, .json, .yaml, .yml, .txt).
Pay special attention to files in scripts/ directory, files referenced by hooks, and files with executable permissions.
Check all non-declarative files for:
Network operations:
curl, wget, fetch, requests.get/post, http.get, axios, urllib, httpxsocket, net.connect, TCP, dgram, WebSocketFile system operations:
$CLAUDE_PLUGIN_ROOT)~/.ssh, ~/.aws, ~/.config/etc/, /usr/, /tmp/ (for persistence).Code obfuscation:
Binary or unreadable files:
Skills and agents control Claude's behavior through prompts.
Check SKILL.md, agent .md files, and command .md files for:
Prompt injection patterns:
Excessive tool permissions:
allowed-tools including Bash, Write, or Edit when not clearly needed*) without justificationdangerouslySkipPermissions or similar bypassesBehavioral manipulation:
Data collection through prompts:
Check plugin.json and directory structure for:
Path traversal:
../Structural integrity:
Metadata concerns:
Assign the overall plugin risk level based on the highest severity finding: