feat(skills): threat scan, lockfile pinning, manifest hardening - #256
Merged
Conversation
- internal/plugin/threatscan.go: threat-pattern scanner (command injection, data exfiltration, encoded payloads, network calls) with 0-100 scoring; installs are refused below the block threshold - internal/plugin/skillslock.go: per-scope skills-lock.json pinning source repo, cloned commit, and content SHA-256; maintained on install and remove - internal/plugin/manifest_hardening.go: bounded symlink-refusing manifest reads with duplicate-JSON-key rejection and strict name and semver patterns, wired into ParseManifestV2 and ValidateV2 - docs: install-time security and lockfile section in user guide
Patel230
enabled auto-merge (squash)
August 24, 2026 16:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports three hardening mechanisms from autohandai/code-cli (Apache-2.0).
Changes
internal/plugin/threatscan.go): 20 pattern rules across command-injection / data-exfiltration / encoded-payload / network-calls, scored 0-100. Installs scoring <30 are refused; warning-band installs report findings.internal/plugin/skillslock.go): per-scopeskills-lock.jsonpinning source repo, cloned commit sha, skill path, and SHA-256 of installed content; maintained on install and remove.internal/plugin/manifest_hardening.gowired intoParseManifestV2/ValidateV2): 64 KiB cap, symlink refusal, UTF-8 check, duplicate-JSON-key rejection, strict name pattern + semver version. One test fixture updated1.0 -> 1.0.0(intentional tightening).docs/user-guide/08-skills.md.Verification
go test ./internal/plugin ./cmdok;go build ./...cleanmake lint0 issues; lefthook hooks green