open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

feat(llm-security): sandboxed remote cloning v5.1.0

Browse source 
Harden git clone attack surface for remote scans with defense-in-depth:

Layer 1 (all platforms): 8 git config flags disable hooks, symlinks,
filter/smudge drivers, fsmonitor, local file protocol. 4 env vars
isolate from system/user git config and block interactive prompts.

Layer 2 (OS sandbox): macOS sandbox-exec and Linux bubblewrap (bwrap)
restrict file writes to only the specific temp directory. bwrap
probe-tests availability before use. Graceful fallback on Windows
and Ubuntu 24.04+ (git config hardening only).

Additional: post-clone 100MB size check, UUID-unique evidence filenames,
evidence file cleanup, cleanup guarantee in scan/plugin-audit commands.

32 new tests (1147 total).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-04-07 17:08:32 +02:00
commit 708c898754
11 changed files with 487 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
plugins/llm-security/commands/plugin-audit.md
View file

@ -21,6 +21,13 @@ Audit a Claude Code plugin for security before installation. Accepts local paths
- Else → `target = "."`, `clone_path = null`
- Verify `.claude-plugin/plugin.json` exists at `<target>`. If not and `clone_path != null` → cleanup clone_path first, then tell user this is not a plugin directory and **STOP**. If not and local → tell user and **STOP**.
## IMPORTANT: Cleanup Guarantee (remote audits)
If `clone_path != null`, the following cleanup MUST run regardless of audit outcome.
If ANY step between clone and cleanup fails or errors, STILL run cleanup before stopping:
1. `node <plugin-root>/scanners/lib/git-clone.mjs cleanup "<clone_path>"`
2. `node <plugin-root>/scanners/lib/fs-utils.mjs cleanup "<evidence_file>"` (if `evidence_file` is set)
## Step 1.5: Pre-extraction (remote audits only)
If `clone_path != null`:
@ -62,3 +69,6 @@ Verdict: **Install** (0 critical/high, transparent hooks) | **Review** (high fin
If `clone_path != null`:
Run: `node <plugin-root>/scanners/lib/git-clone.mjs cleanup "<clone_path>"`
If cleanup fails → warn: "Could not remove temp dir <clone_path> — remove manually."
If `evidence_file != null`:
Run: `node <plugin-root>/scanners/lib/fs-utils.mjs cleanup "<evidence_file>"`

10
plugins/llm-security/commands/scan.md
View file

@ -21,6 +21,13 @@ Scan target for security issues. Accepts local paths or GitHub URLs. Delegates t
Set `remote_url = <url>` for display
- Otherwise → `target = $ARGUMENTS`, `clone_path = null`
## IMPORTANT: Cleanup Guarantee (remote scans)
If `clone_path != null`, the following cleanup MUST run regardless of scan outcome.
If ANY step between clone and cleanup fails or errors, STILL run cleanup before stopping:
1. `node <plugin-root>/scanners/lib/git-clone.mjs cleanup "<clone_path>"`
2. `node <plugin-root>/scanners/lib/fs-utils.mjs cleanup "<evidence_file>"` (if `evidence_file` is set)
## Step 1.5: Pre-extraction (remote scans only)
If `clone_path != null` (target is a cloned remote repo):
@ -145,3 +152,6 @@ Parse stdout aggregate JSON. Merge with LLM findings. Re-evaluate verdict. Outpu
If `clone_path != null`:
Run: `node <plugin-root>/scanners/lib/git-clone.mjs cleanup "<clone_path>"`
If cleanup fails → warn: "Could not remove temp dir <clone_path> — remove manually."
If `evidence_file != null`:
Run: `node <plugin-root>/scanners/lib/fs-utils.mjs cleanup "<evidence_file>"`