Claude Code plug-ins run with full access to a user's terminal, files, and environment variables, yet the marketplace has no centralized vetting, code signing, or sandboxing. This guide lays out repository-level defenses maintainers should adopt: branch protection with no admin bypass, mandatory two-person PR review, CI gates (linting, secret scanning, static analysis, dependency pinning), isolated and OIDC-based publishing with immutable tags, and incident-response documentation. It highlights that SKILL.md files are the one attack surface with no automated defense, since malicious prompt injection instructions read like ordinary prose and bypass static analysis entirely, illustrated by a real disclosed vulnerability in the Hookify plug-in. It closes with a 5-minute checklist end users can run to audit a plug-in's repository before installing.
Table of contents
What a plug-in can do and where it can be attackedPractice 1: Lock down who can write to the branchPractice 2: No one merges without a second personPractice 3: Continuous integration gates that block the mergePractice 4: Prove your claims in CI, and isolate publishingPractice 5: Document what the plug-in does, and what you'll do when it breaksThe surface without a defenseChecklistSo what can a user do?Questions this post answers
How was the Hookify plug-in for Claude Code exploited through prompt injection?
Hookify, distributed through Anthropic's official Claude Code marketplace, read rule files from the project directory and fed their contents into the hook subsystem's trusted channel. An attacker could plant a file in a repository to inject instructions; tested against Claude Opus 4.6, 5 payloads disguised as project conventions caused the model to leak environment variables and local secrets, and none were flagged as injection. Anthropic closed the report as working as designed. Developers evaluating AI coding plug-in risks can track supply-chain security research like this on daily.dev.
Why can't static analysis or secret scanning catch malicious Claude Code SKILL.md files?
SKILL.md files are Markdown injected directly into the model's instructions, so a malicious instruction is natural language indistinguishable in form from legitimate content, not code. Tools like Gitleaks for secret scanning or Bandit and Semgrep for static analysis have nothing to analyze since there is no executable code, only prose that may be adversarial, so human review is the only defense. Teams securing AI agent pipelines can follow practical mitigation checklists like this on daily.dev.
What should I check in a Claude Code plug-in's repository before installing it to avoid a supply chain attack?
Check for branch protection with required reviews on main, releases cut from immutable tags rather than a moving default branch, a SECURITY.md file with a reporting contact, a data-access document listing what the plug-in reads and transmits, Trusted Publishing via OIDC instead of long-lived tokens, and a healthy multi-contributor commit history. Absence of these collectively signals the maintainer never considered plug-in security. Anyone vetting third-party AI coding tools can find security checklists like this on daily.dev.