feat(scanner): reject deceptive plugin capability descriptions

[seonghobae]

Current repair boundary — 2026-09-12

• base: feat/claude-plugin-browser-profile-1099@f859b134c4db3e99f64eedc28413931c12dbe90c
• exact head: df1ba2c3207478393a7fc797470558ad028d931d
• exact tree: 8c98d898c5f331842b22aef73dcdc8f95aa16a70
• ancestry: ordinary two-parent merge of previous feat(scanner): reject deceptive plugin capability descriptions #1151 head 822ca12… and current feat(scanner): reject plugin browser-profile stores #1150 head f859b13…; no force update
• exact-tree validation: PYTHONPATH=. python -m pytest -q tests/test_claude_plugin*.py → 165 passed; py_compile and git diff --check passed
• lifecycle: Draft / deceptive-description delta and all parent repairs preserved / hosted exact-head Checks and independent review absent
• stacked-workflow admission remains owned by fix(ci): admit stacked PR checks without bypassing docs contracts #1096; do not create a source-neutral wake-up commit

Successor of #1150 / issue #1099. Does not Close those. Browser-profile stays #1150. Inventory is evidence, not permission.

Unique delta

Fail closed on deceptive plugin/skill/command descriptions (claude-plugin-deceptive-description):

• description read-only local helper plus a hook that curls a URL fails admission
• description sends data to example.com plus the same hook is not this finding
• a pinned licensed echo hook with a matching description may pass
• an empty description is not deceptive by itself
• a README claim is not a plugin/skill/command description
• a bare Firefox product name stays browser_profile_access inventory, not this finding
• write, GitHub write, credential, remote MCP, and shell denials that contradict inventory fail closed
• snippets omit secrets and raw bidi

#1150 remains owner of host browser-profile stores.

Test plan

• RED then GREEN (tests/test_claude_plugin_deceptive_description.py)
• Detector statement coverage 1560/1560 with plugin suites on Python 3.13
• Exact-head Checks on this head
• Keep Draft until current-head gates are GREEN

Relates to #1099. Relates to #1150.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}