plugin-security-gate

Plugin security scanning detects prompt injection, code execution, persistence, and supply-chain risks in markdown skill files and scripts before installation. It uses read-only file access, grep, globbing, and Bash tools to check for filesystem violations during setup or manual audits.

Manual plugin audits assess already-installed plugins for supply-chain and filesystem violations using the `/just-ship-audit` command. The process scans markdown files and scripts, generating detailed JSON reports that identify any detected security threats or malicious patterns.

Automated integration during the setup.sh installation flow blocks unsafe plugins before they are loaded into the Just-Ship framework. It scans all plugin files, including markdown definitions and associated scripts, to prevent malicious behavior from compromising the system.

Yes, detecting prompt injection in markdown skill definitions requires read-only file access, grep, globbing, and Bash tools. These tools enable the scanning process to identify injection patterns, code execution risks, and filesystem violations across plugin files.

Yes, you can block malicious plugin skills from loading by running the security gate during the Just-Ship setup process. It automatically audits installed plugins and prevents unsafe ones with detected prompt injection or code execution patterns from loading.