Security Scan Patterns for Claude Code Plugins
Execution Surfaces
Claude Code plugins have five execution surfaces that must be scanned:
| Surface |
Files |
Risk Level |
Why |
| Hooks |
hooks/hooks.json, referenced scripts |
Critical |
Runs on EVERY tool call automatically |
| Scripts |
scripts/*.sh, *.py, *.js |
High |
Executed by commands/agents |
| MCP Servers |
.mcp.json |
High |
Network access, data flow |
| Bash in commands |
commands/*.md with Bash tool |
Medium |
Shell execution via Claude |
| Install scripts |
package.json postinstall, setup scripts |
Medium |
Runs on install |
Dangerous Shell Patterns
Critical (immediate risk)
| Pattern |
Regex |
Why |
| Pipe to shell |
curl.*|.*sh, wget.*|.*bash |
Remote code execution |
| Eval with variables |
eval\s+["']?\$ |
Arbitrary code execution |
| Reverse shell |
bash\s+-i\s+>&, /dev/tcp/ |
Backdoor |
| Base64 decode and exec |
base64.*|.*sh, base64.*|.*python |
Obfuscated execution |
| SSH key exfiltration |
cat.*\.ssh/, scp.*\.ssh/ |
Key theft |
| Token exfiltration |
Secrets like GITHUB_TOKEN or API keys sent to curl/wget |
Credential theft |
High (likely dangerous)
| Pattern |
Regex |
Why |
| Subprocess with shell=True |
subprocess\.(call|run|Popen).*shell\s*=\s*True |
Python shell injection |
| OS system calls |
os\.system\( |
Python shell execution |
| Dynamic require/import |
require\(\s*\$, import\(\s*\$ |
Dynamic code loading |
| File write outside repo |
> ~/, > /etc/, > /tmp/.*\.sh |
System modification |
| Sudo usage |
sudo\s+ |
Privilege escalation |
| PATH modification |
Appending to bashrc, zshrc, or profile |
Persistent system modification |
Medium (context-dependent)
| Pattern |
Regex |
Why |
| Network calls |
curl\s+, wget\s+, fetch\(, requests\.(get|post) |
Data exfiltration potential |
| Environment access |
process\.env, os\.environ, shell variable expansion |
Sensitive data access |
| File reads outside repo |
Reading from home directory or system paths |
Data access |
| Runtime package install |
npm install, pip install, gem install |
Supply chain risk |
| Shell exec functions |
Functions that execute strings as shell commands |
Shell execution |
MCP Configuration Risks
Scan .mcp.json for:
| Risk |
Check |
Severity |
| Remote servers |
url field pointing to non-localhost |
High |
| Unknown domains |
Domain not in known-safe list |
High |
| Broad permissions |
permissions with wildcard or extensive list |
Medium |
| File system access |
Server with fs or filesystem capability |
Medium |
| Shell access |
Server with shell or execution capability |
Critical |
| Missing auth |
Remote server without auth field |
High |
Known-safe MCP domains: localhost, 127.0.0.1, modelcontextprotocol.io, github.com, api.anthropic.com
Hook Safety Rules
Scan hooks/hooks.json for:
| Risk |
Check |
Severity |
| Hook runs shell script |
command field references .sh, .py, .js |
Medium (must scan the script) |
| Hook uses user input |
Script receives prompt or input variables without sanitization |
High |
| Hook on every event |
Triggers on PreToolUse or PostToolUse without tool filter |
Medium |
| Hook modifies files |
Script writes to disk on every tool call |
Medium |
| Hook makes network calls |
Script contains network request commands |
High |
Dependency Supply Chain
Scan package.json for:
| Risk |
Check |
Severity |
| postinstall scripts |
scripts.postinstall exists |
High |
| preinstall scripts |
scripts.preinstall exists |
High |
| Git URL dependencies |
Deps pointing to git URLs |
Medium |
| Unpinned versions |
Wildcard or "latest" version |
Medium |
Scan requirements.txt / pyproject.toml for:
| Risk |
Check |
Severity |
| Git URL deps |
git+https or git+ssh URLs |
Medium |
| Unpinned |
No version pin |
Low |
| Direct URL |
HTTP download URLs |
High |
Prompt Injection Surfaces
| Risk |
Check |
Severity |
| Untrusted file content in prompts |
Agent reads arbitrary file then uses content in Bash |
High |
| User input passed to shell |
Command takes arguments and passes to Bash without sanitization |
Critical |
| Template expansion |
Variable expansion in hook scripts with user-controlled values |
High |
Severity Definitions
| Severity |
Meaning |
Action |
| Critical |
Immediate exploitation risk: RCE, credential theft, backdoor |
Block contribution, file security issue |
| High |
Likely dangerous: shell injection, data exfil, privilege escalation |
Block contribution, report in audit |
| Medium |
Context-dependent: network calls, env access, runtime installs |
Report in audit, flag for review |
| Low |
Minor concern: unpinned deps, broad permissions |
Report as informational |
Report Format
The security scan section in an audit report follows this structure:
## Security Scan
| Severity | Count |
|----------|-------|
| Critical | N |
| High | N |
| Medium | N |
| Low | N |
### Findings
| # | Severity | File | Line | Pattern | Description |
|---|----------|------|------|---------|-------------|
Risk Gate
If any Critical or High findings exist, the contribute-approved label must NOT be applied. The audit report must include a prominent warning and the tracking issue must link to the security findings.
1---2name: security3description: Security pattern database for Claude Code plugin audits. Covers execution surfaces, supply chain, data exfiltration, and prompt injection.4---56# Security Scan Patterns for Claude Code Plugins78## Execution Surfaces910Claude Code plugins have five execution surfaces that must be scanned:1112| Surface | Files | Risk Level | Why |13|---------|-------|------------|-----|14| Hooks | `hooks/hooks.json`, referenced scripts | Critical | Runs on EVERY tool call automatically |15| Scripts | `scripts/*.sh`, `*.py`, `*.js` | High | Executed by commands/agents |16| MCP Servers | `.mcp.json` | High | Network access, data flow |17| Bash in commands | `commands/*.md` with Bash tool | Medium | Shell execution via Claude |18| Install scripts | `package.json` postinstall, setup scripts | Medium | Runs on install |1920## Dangerous Shell Patterns2122### Critical (immediate risk)2324| Pattern | Regex | Why |25|---------|-------|-----|26| Pipe to shell | `curl.*\|.*sh`, `wget.*\|.*bash` | Remote code execution |27| Eval with variables | `eval\s+["']?\$` | Arbitrary code execution |28| Reverse shell | `bash\s+-i\s+>&`, `/dev/tcp/` | Backdoor |29| Base64 decode and exec | `base64.*\|.*sh`, `base64.*\|.*python` | Obfuscated execution |30| SSH key exfiltration | `cat.*\.ssh/`, `scp.*\.ssh/` | Key theft |31| Token exfiltration | Secrets like GITHUB_TOKEN or API keys sent to curl/wget | Credential theft |3233### High (likely dangerous)3435| Pattern | Regex | Why |36|---------|-------|-----|37| Subprocess with shell=True | `subprocess\.(call\|run\|Popen).*shell\s*=\s*True` | Python shell injection |38| OS system calls | `os\.system\(` | Python shell execution |39| Dynamic require/import | `require\(\s*\$`, `import\(\s*\$` | Dynamic code loading |40| File write outside repo | `> ~/`, `> /etc/`, `> /tmp/.*\.sh` | System modification |41| Sudo usage | `sudo\s+` | Privilege escalation |42| PATH modification | Appending to bashrc, zshrc, or profile | Persistent system modification |4344### Medium (context-dependent)4546| Pattern | Regex | Why |47|---------|-------|-----|48| Network calls | `curl\s+`, `wget\s+`, `fetch\(`, `requests\.(get\|post)` | Data exfiltration potential |49| Environment access | `process\.env`, `os\.environ`, shell variable expansion | Sensitive data access |50| File reads outside repo | Reading from home directory or system paths | Data access |51| Runtime package install | `npm install`, `pip install`, `gem install` | Supply chain risk |52| Shell exec functions | Functions that execute strings as shell commands | Shell execution |5354## MCP Configuration Risks5556Scan `.mcp.json` for:5758| Risk | Check | Severity |59|------|-------|----------|60| Remote servers | `url` field pointing to non-localhost | High |61| Unknown domains | Domain not in known-safe list | High |62| Broad permissions | `permissions` with wildcard or extensive list | Medium |63| File system access | Server with `fs` or `filesystem` capability | Medium |64| Shell access | Server with `shell` or execution capability | Critical |65| Missing auth | Remote server without `auth` field | High |6667Known-safe MCP domains: `localhost`, `127.0.0.1`, `modelcontextprotocol.io`, `github.com`, `api.anthropic.com`6869## Hook Safety Rules7071Scan `hooks/hooks.json` for:7273| Risk | Check | Severity |74|------|-------|----------|75| Hook runs shell script | `command` field references `.sh`, `.py`, `.js` | Medium (must scan the script) |76| Hook uses user input | Script receives prompt or input variables without sanitization | High |77| Hook on every event | Triggers on PreToolUse or PostToolUse without tool filter | Medium |78| Hook modifies files | Script writes to disk on every tool call | Medium |79| Hook makes network calls | Script contains network request commands | High |8081## Dependency Supply Chain8283Scan `package.json` for:8485| Risk | Check | Severity |86|------|-------|----------|87| postinstall scripts | `scripts.postinstall` exists | High |88| preinstall scripts | `scripts.preinstall` exists | High |89| Git URL dependencies | Deps pointing to git URLs | Medium |90| Unpinned versions | Wildcard or "latest" version | Medium |9192Scan `requirements.txt` / `pyproject.toml` for:9394| Risk | Check | Severity |95|------|-------|----------|96| Git URL deps | git+https or git+ssh URLs | Medium |97| Unpinned | No version pin | Low |98| Direct URL | HTTP download URLs | High |99100## Prompt Injection Surfaces101102| Risk | Check | Severity |103|------|-------|----------|104| Untrusted file content in prompts | Agent reads arbitrary file then uses content in Bash | High |105| User input passed to shell | Command takes arguments and passes to Bash without sanitization | Critical |106| Template expansion | Variable expansion in hook scripts with user-controlled values | High |107108## Severity Definitions109110| Severity | Meaning | Action |111|----------|---------|--------|112| Critical | Immediate exploitation risk: RCE, credential theft, backdoor | Block contribution, file security issue |113| High | Likely dangerous: shell injection, data exfil, privilege escalation | Block contribution, report in audit |114| Medium | Context-dependent: network calls, env access, runtime installs | Report in audit, flag for review |115| Low | Minor concern: unpinned deps, broad permissions | Report as informational |116117## Report Format118119The security scan section in an audit report follows this structure:120121```122## Security Scan123124| Severity | Count |125|----------|-------|126| Critical | N |127| High | N |128| Medium | N |129| Low | N |130131### Findings132133| # | Severity | File | Line | Pattern | Description |134|---|----------|------|------|---------|-------------|135```136137## Risk Gate138139If any Critical or High findings exist, the `contribute-approved` label must NOT be applied. The audit report must include a prominent warning and the tracking issue must link to the security findings.
shengdabai