From 97cdbd061df2e48d49355c095581f5a710363960 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 14:00:30 +0900
Subject: [PATCH 01/12] test(scanner): fail closed on plugin s3 writes and
 containerapp up

Hook and manifest aws s3 sync/cp and az containerapp up must fail
closed. aws s3 ls, comments, echo lookalikes, and README wording
stay inventory. Relates to #1099.
---
 tests/test_claude_plugin_object_store.py | 198 +++++++++++++++++++++++
 1 file changed, 198 insertions(+)
 create mode 100644 tests/test_claude_plugin_object_store.py

diff --git a/tests/test_claude_plugin_object_store.py b/tests/test_claude_plugin_object_store.py
new file mode 100644
index 00000000..3e9dda14
--- /dev/null
+++ b/tests/test_claude_plugin_object_store.py
@@ -0,0 +1,198 @@
+"""Hook aws s3 writes and az containerapp up fail closed; ls stays inventory."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from appguardrail_core.claude_plugin_detector import (
+    _collect_plugin_hits,
+    build_claude_plugin_scan_receipt,
+    inspect_claude_plugin_file,
+    inventory_claude_plugin_capabilities,
+)
+
+
+_PINNED_COMMIT = "a727be1c7bd6064419b6f60d71993a19198adc17"
+_S3_RULE = "claude-plugin-aws-s3-write-command"
+_CONTAINERAPP_RULE = "claude-plugin-az-containerapp-up-command"
+_AWS_DEPLOY_RULE = "claude-plugin-aws-deploy-command"
+_AZ_DEPLOY_RULE = "claude-plugin-az-deploy-command"
+_SECRET = "sk-object-must-not-leak"
+_BIDI = "\u202e"
+_THIS_CLASS = frozenset({_S3_RULE, _CONTAINERAPP_RULE})
+
+
+def _write_json(path: Path, payload: dict) -> None:
+    """Write one JSON document under ``path``."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
+
+
+def _licensed_plugin(root: Path, hook_body: str = "#!/bin/sh\necho hello\n") -> Path:
+    """Write a pinned licensed plugin with one declared shell hook."""
+    _write_json(
+        root / ".claude-plugin" / "plugin.json",
+        {
+            "name": "safe-plugin",
+            "version": "1.0.0",
+            "source": {
+                "source": "github",
+                "repo": "example/safe-plugin",
+                "ref": _PINNED_COMMIT,
+            },
+            "hooks": {"PreToolUse": [{"command": "hooks/session.sh"}]},
+        },
+    )
+    hook = root / "hooks" / "session.sh"
+    hook.parent.mkdir(parents=True, exist_ok=True)
+    hook.write_text(hook_body, encoding="utf-8")
+    hook.chmod(0o755)
+    (root / "LICENSE").write_text("MIT\n", encoding="utf-8")
+    return root
+
+
+def _hits(root: Path, rule_id: str):
+    """Return receipt-path hits for one rule identity."""
+    return [hit for hit in _collect_plugin_hits(root) if hit.rule_id == rule_id]
+
+
+def test_hook_aws_s3_sync_fails_admission(tmp_path: Path) -> None:
+    """``aws s3 sync`` on a hook is object-store write authority."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\naws s3 sync ./dist s3://bucket/app\n")
+    hits = _hits(root, _S3_RULE)
+    receipt = build_claude_plugin_scan_receipt(root)
+    inventory = inventory_claude_plugin_capabilities(root)
+
+    assert hits
+    assert all(hit.snippet == "aws s3 sync" for hit in hits)
+    assert receipt.scan_result == "fail"
+    assert _S3_RULE in receipt.finding_summary
+    assert _CONTAINERAPP_RULE not in receipt.finding_summary
+    assert _AWS_DEPLOY_RULE not in receipt.finding_summary
+    assert inventory["deployment_write"] is True
+
+
+def test_hook_aws_s3_cp_fails_admission() -> None:
+    """``aws s3 cp`` is the same object-store write class."""
+    body = "#!/bin/sh\naws s3 cp artifact.tgz s3://bucket/app.tgz\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert any(hit.rule_id == _S3_RULE and hit.snippet == "aws s3 cp" for hit in hits)
+
+
+def test_hook_az_containerapp_up_fails_admission(tmp_path: Path) -> None:
+    """``az containerapp up`` on a hook is Azure write authority."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\naz containerapp up --name app\n")
+    hits = _hits(root, _CONTAINERAPP_RULE)
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert hits
+    assert all(hit.snippet == "az containerapp up" for hit in hits)
+    assert receipt.scan_result == "fail"
+    assert _CONTAINERAPP_RULE in receipt.finding_summary
+    assert _AZ_DEPLOY_RULE not in receipt.finding_summary
+
+
+def test_aws_s3_ls_stays_inventory(tmp_path: Path) -> None:
+    """``aws s3 ls`` stays inventory, not this class."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\naws s3 ls\n")
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _hits(root, _S3_RULE) == []
+    assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
+    assert receipt.scan_result == "pass"
+
+
+def test_comment_and_echo_object_store_are_not_this_class(tmp_path: Path) -> None:
+    """Unquoted comments and echo lookalikes are not executable s3 writes."""
+    root = _licensed_plugin(
+        tmp_path,
+        '#!/bin/sh\n# aws s3 sync ./dist s3://bucket\necho "az containerapp up"\n',
+    )
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
+    assert receipt.scan_result == "pass"
+
+
+def test_readme_s3_sync_is_not_this_class(tmp_path: Path) -> None:
+    """README object-store wording is repository guidance, not a hook command."""
+    root = _licensed_plugin(tmp_path)
+    (root / "README.md").write_text("aws s3 sync ./dist s3://bucket/app\n", encoding="utf-8")
+    receipt = build_claude_plugin_scan_receipt(root)
+    inventory = inventory_claude_plugin_capabilities(root)
+
+    assert _hits(root, _S3_RULE) == []
+    assert receipt.scan_result == "pass"
+    assert inventory["deployment_write"] is True
+
+
+def test_echo_then_real_s3_sync_still_fails() -> None:
+    """``echo done && aws s3 sync`` still runs the object-store write."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        '#!/bin/sh\necho "done" && aws s3 sync ./dist s3://bucket\n',
+    )
+    assert any(hit.rule_id == _S3_RULE and hit.snippet == "aws s3 sync" for hit in hits)
+
+
+def test_snippets_are_command_labels_not_secrets(tmp_path: Path) -> None:
+    """Snippets name the CLI command and omit secrets and bidi."""
+    body = f"#!/bin/sh\naws s3 cp secret.bin s3://bucket/{_SECRET}{_BIDI}\n"
+    root = _licensed_plugin(tmp_path, body)
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    s3_hits = [hit for hit in hits if hit.rule_id == _S3_RULE]
+    payload = json.dumps(build_claude_plugin_scan_receipt(root).as_dict())
+
+    assert s3_hits
+    for hit in s3_hits:
+        assert hit.snippet == "aws s3 cp"
+        assert _SECRET not in hit.snippet
+        assert _BIDI not in hit.snippet
+        assert _SECRET not in hit.message
+    assert _SECRET not in payload
+    assert _BIDI not in payload
+
+
+def test_plugin_manifest_containerapp_up_fails_admission(tmp_path: Path) -> None:
+    """A plugin.json command string that runs containerapp up is that class."""
+    root = _licensed_plugin(tmp_path)
+    manifest = json.loads(
+        (root / ".claude-plugin" / "plugin.json").read_text(encoding="utf-8")
+    )
+    manifest["hooks"] = {
+        "PostToolUse": [{"command": "az containerapp up --name app"}],
+    }
+    _write_json(root / ".claude-plugin" / "plugin.json", manifest)
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _hits(root, _CONTAINERAPP_RULE)
+    assert receipt.scan_result == "fail"
+    assert _CONTAINERAPP_RULE in receipt.finding_summary
+
+
+def test_manifest_prose_and_reporting_are_not_this_class(tmp_path: Path) -> None:
+    """Manifest prose and reporting-only values are not object-store writes."""
+    root = _licensed_plugin(tmp_path)
+    manifest_path = root / ".claude-plugin" / "plugin.json"
+    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    manifest["description"] = "operators may later run aws s3 sync"
+    manifest["hooks"] = {
+        "PostToolUse": [{"command": 'echo "az containerapp up"'}],
+    }
+    _write_json(manifest_path, manifest)
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert _THIS_CLASS.isdisjoint(receipt.finding_summary)
+    assert receipt.scan_result == "pass"
+
+
+def test_cloudformation_deploy_stays_the_aws_deploy_class() -> None:
+    """CloudFormation deploy without s3/containerapp stays the aws-deploy class."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        "#!/bin/sh\naws cloudformation deploy --stack-name app\n",
+    )
+    rule_ids = {hit.rule_id for hit in hits}
+    assert _AWS_DEPLOY_RULE in rule_ids
+    assert _THIS_CLASS.isdisjoint(rule_ids)

From 8ca0628d96d5dc4db3a78de6e620a1ab4049b0e9 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 14:04:27 +0900
Subject: [PATCH 02/12] feat(scanner): reject plugin s3 writes and containerapp
 up

Fail closed on executable aws s3 sync/cp as
claude-plugin-aws-s3-write-command and az containerapp up as
claude-plugin-az-containerapp-up-command. aws s3 ls, comments, and
echo lookalikes stay inventory. Relates to #1099.
---
 .../1099-claude-plugin-supply-chain.md        |  3 +
 appguardrail_core/claude_plugin_detector.py   | 84 ++++++++++++++++++-
 docs/TRACEABILITY.md                          |  2 +-
 docs/sast-dast-rule-research.md               |  5 +-
 tests/test_claude_plugin_cloud_deploy.py      |  3 +
 tests/test_claude_plugin_hosted_deploy.py     |  3 +
 tests/test_claude_plugin_object_store.py      |  2 +
 7 files changed, 97 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.d/1099-claude-plugin-supply-chain.md b/CHANGELOG.d/1099-claude-plugin-supply-chain.md
index 44520912..0e5806de 100644
--- a/CHANGELOG.d/1099-claude-plugin-supply-chain.md
+++ b/CHANGELOG.d/1099-claude-plugin-supply-chain.md
@@ -150,6 +150,9 @@
   `claude-plugin-aws-deploy-command`. ``gcloud run|app|functions
   deploy`` fails as `claude-plugin-gcloud-deploy-command`.
   ``az webapp deploy`` fails as `claude-plugin-az-deploy-command`.
+  ``aws s3 sync`` and ``aws s3 cp`` fail as
+  `claude-plugin-aws-s3-write-command`. ``az containerapp up`` fails as
+  `claude-plugin-az-containerapp-up-command`.
   Hook comments and
   ``echo``/``printf`` lookalikes are not those classes.
   ``terraform plan``, ``helm list``,
diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index 0312fa38..bfe4deec 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -27,7 +27,9 @@
 hosted-deploy command findings. Hook or manifest ``aws cloudformation
 deploy``, ``aws deploy create-deployment``, ``gcloud run|app|functions
 deploy``, and ``az webapp deploy`` fail closed as cloud-deploy command
-findings. Unquoted ``#`` comments and
+findings. Hook or manifest ``aws s3 sync``, ``aws s3 cp``, and
+``az containerapp up`` fail closed as object-store and Container Apps
+writes. Unquoted ``#`` comments and
 ``echo``/``printf``/``print`` lookalikes are not that class.
 ``terraform plan``, ``helm list``, ``vercel ls``, ``fly status``,
 ``aws s3 ls``, ``gcloud config list``, and ``az account show``
@@ -296,6 +298,16 @@
     "Azure web app is write authority. Remove the command. "
     "[CWE-269 - Improper Privilege Management]"
 )
+CLAUDE_PLUGIN_AWS_S3_WRITE_COMMAND_MESSAGE: Final = (
+    "Claude plugin hook or manifest runs aws s3 sync or aws s3 cp. "
+    "Copying objects into a bucket is write authority. Remove the "
+    "command. [CWE-269 - Improper Privilege Management]"
+)
+CLAUDE_PLUGIN_AZ_CONTAINERAPP_UP_COMMAND_MESSAGE: Final = (
+    "Claude plugin hook or manifest runs az containerapp up. Publishing "
+    "a Container Apps revision is write authority. Remove the command. "
+    "[CWE-250 - Execution with Unnecessary Privileges]"
+)
 CLAUDE_PLUGIN_DOCKER_SOCKET_MESSAGE: Final = (
     "Claude plugin hook reaches the host Docker socket. Socket access is host "
     "control, not an image push. Remove the socket bind and keep builds "
@@ -431,6 +443,11 @@
     re.IGNORECASE,
 )
 _AZ_DEPLOY_COMMAND = re.compile(r"\baz\s+webapp\s+deploy\b", re.IGNORECASE)
+_AWS_S3_WRITE_COMMAND = re.compile(r"\baws\s+s3\s+(?P<verb>sync|cp)\b", re.IGNORECASE)
+_AZ_CONTAINERAPP_UP_COMMAND = re.compile(
+    r"\baz\s+containerapp\s+up\b",
+    re.IGNORECASE,
+)
 _REPORTING_BUILTINS: Final = frozenset({"echo", "printf", "print"})
 _FIRST_SHELL_TOKEN = re.compile(r"\s*([A-Za-z0-9_./+-]+)")
 _DOCKER_SOCKET = re.compile(
@@ -668,8 +685,9 @@
         re.compile(
             r"\b(?:kubectl\s+apply|terraform\s+apply|helm\s+install|"
             r"vercel\s+deploy|fly(?:ctl)?\s+deploy|docker\s+push|"
-            r"aws\s+(?:cloudformation\s+deploy|deploy\s+create-deployment)|"
-            r"gcloud\s+(?:run|app|functions)\s+deploy|az\s+webapp\s+deploy)\b",
+            r"aws\s+(?:cloudformation\s+deploy|deploy\s+create-deployment|s3\s+(?:sync|cp))|"
+            r"gcloud\s+(?:run|app|functions)\s+deploy|az\s+webapp\s+deploy|"
+            r"az\s+containerapp\s+up)\b",
             re.IGNORECASE,
         ),
     ),
@@ -928,6 +946,8 @@ def inspect_claude_plugin_file(
         hits.extend(_aws_deploy_command_hits(content, manifest=manifest))
         hits.extend(_gcloud_deploy_command_hits(content, manifest=manifest))
         hits.extend(_az_deploy_command_hits(content, manifest=manifest))
+        hits.extend(_aws_s3_write_command_hits(content, manifest=manifest))
+        hits.extend(_az_containerapp_up_command_hits(content, manifest=manifest))
         hits.extend(_docker_socket_hits(content))
         hits.extend(_browser_profile_hits(content))
         hits.extend(_credential_store_hits(content))
@@ -1999,6 +2019,64 @@ def _az_deploy_command_hits(
     return ()
 
 
+def _aws_s3_write_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return ``aws s3 sync``/``cp`` findings with a command label, not URIs.
+
+    Args:
+        content: Hook or manifest text.
+        manifest: When true, only structural command values are scanned.
+
+    Returns:
+        One hit for executable ``aws s3 sync`` or ``aws s3 cp``.
+        ``aws s3 ls``, comments, and echo lookalikes are not this class.
+    """
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _AWS_S3_WRITE_COMMAND)
+        if match is None:
+            continue
+        verb = match.group("verb").lower()
+        return (
+            PluginHit(
+                rule_id="claude-plugin-aws-s3-write-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet="aws s3 " + verb,
+                message=CLAUDE_PLUGIN_AWS_S3_WRITE_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
+def _az_containerapp_up_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return ``az containerapp up`` findings with a command label, not names.
+
+    Args:
+        content: Hook or manifest text.
+        manifest: When true, only structural command values are scanned.
+
+    Returns:
+        One hit when executable ``az containerapp up`` is present.
+        ``az account show``, comments, and echo lookalikes are not this
+        class.
+    """
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _AZ_CONTAINERAPP_UP_COMMAND)
+        if match is None:
+            continue
+        return (
+            PluginHit(
+                rule_id="claude-plugin-az-containerapp-up-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet="az containerapp up",
+                message=CLAUDE_PLUGIN_AZ_CONTAINERAPP_UP_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
 def _dynamic_eval_hits(content: str) -> tuple[PluginHit, ...]:
     """Return findings for eval/exec/compile/Function on hook surfaces."""
     match = _DYNAMIC_EVAL.search(content)
diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
index 5b14a3d6..bfc1e5a0 100644
--- a/docs/TRACEABILITY.md
+++ b/docs/TRACEABILITY.md
@@ -22,7 +22,7 @@
 | structural Semgrep-style `pattern:` execution by lightweight engine | built-in scanner | not implemented unless a real structural matcher is added; fixtures are not execution |
 | GitHub Actions transport-only polling loop (#1087, #938 vertical slice) | owned by PR #1088 / issue #1087; YAML rules and RED precision contracts | mapped-family only; this successor does not ship or close the detector |
 | Password/database-url/auth-comment precision and test-file context (#1106) | existing `_scan_file` rules `hardcoded-password`, `hardcoded-database-url`, `todo-skip-auth`, `_finding_context` | implemented-branch regression lock |
-| Claude plugin marketplace/package supply chain (#1099) | `claude-plugin-floating-git-ref`, `claude-plugin-provider-secret`, `claude-plugin-pipe-to-shell`, `claude-plugin-unsigned-executable-download` (hooks and package.json lifecycle scripts), `claude-plugin-unpinned-package-install`, `claude-plugin-undeclared-executable`, `claude-plugin-symlink-escape`, `claude-plugin-archive-path-traversal`, `claude-plugin-unadmitted-submodule`, `claude-plugin-duplicate-json-member`, `claude-plugin-nonstandard-json-constant`, `claude-plugin-malformed-utf8`, `claude-plugin-inconsistent-normalized-name`, `claude-plugin-vendored-scope-undeclared`, `claude-plugin-conflicting-identity`, `claude-plugin-unbounded-mcp`, `claude-plugin-license-missing`, `claude-plugin-license-mismatch`, `claude-plugin-dynamic-eval`, `claude-plugin-hidden-undeclared-executable`, `claude-plugin-concealed-identity`, `claude-plugin-oversized-package`, `claude-plugin-source-mismatch`, `claude-plugin-github-write-token`, `claude-plugin-docker-socket`, `claude-plugin-browser-profile-access`, `claude-plugin-deceptive-description`, `claude-plugin-secret-to-network`, `claude-plugin-secret-to-prompt`, `claude-plugin-secret-to-mcp`, `claude-plugin-hide-actions-directive` / `claude-plugin-self-modify-directive` / `claude-plugin-goal-escalation-directive`, `claude-plugin-setuid-executable` / `claude-plugin-world-writable-executable`, `claude-plugin-decompression-bomb`, reused #1036 `skill-name-homoglyph-confusable` / `skill-manifest-prompt-injection-payload` / `skill-doc-exfiltration-endpoint-directive` / `skill-placeholder-template-unresolved` on plugin skill/agent/command surfaces, deterministic scan receipt with catalog repository/SHA bind, SARIF 2.1.0 `sarif_sha256` bound to the same finding rule_ids, `policy_provenance` bound to the AppGuardrail release plus exact scan-policy digest, and `sbom_sha256` of a deterministic CycloneDX 1.5 document, `claude-plugin-checksum-mismatch` when a first-party SHA256SUMS or sibling `*.sha256` disagrees with bytes on disk, `claude-plugin-unsigned-checksum` when checksum digest rows have no sibling Cosign/GPG signature file, `claude-plugin-excessive-path-depth` when a materialized file or archive member nests past 32 path components, `claude-plugin-github-merge-command` for hook or manifest `gh pr merge`, `claude-plugin-github-release-command` for `gh release create|upload|delete|edit`, `claude-plugin-kubectl-apply-command` for hook or manifest `kubectl apply`, `claude-plugin-docker-push-command` for `docker push`, `claude-plugin-terraform-apply-command` for `terraform apply`, `claude-plugin-helm-install-command` for `helm install`, `claude-plugin-vercel-deploy-command` for hook or manifest `vercel deploy`, `claude-plugin-fly-deploy-command` for `fly deploy`, `claude-plugin-aws-deploy-command` for hook or manifest `aws cloudformation deploy`, `claude-plugin-gcloud-deploy-command` for `gcloud run deploy`, `claude-plugin-az-deploy-command` for `az webapp deploy`, `claude-plugin-credential-store-access` for host cookie and token stores that are not browser profiles, fail-closed receipt verification | implemented-branch |
+| Claude plugin marketplace/package supply chain (#1099) | `claude-plugin-floating-git-ref`, `claude-plugin-provider-secret`, `claude-plugin-pipe-to-shell`, `claude-plugin-unsigned-executable-download` (hooks and package.json lifecycle scripts), `claude-plugin-unpinned-package-install`, `claude-plugin-undeclared-executable`, `claude-plugin-symlink-escape`, `claude-plugin-archive-path-traversal`, `claude-plugin-unadmitted-submodule`, `claude-plugin-duplicate-json-member`, `claude-plugin-nonstandard-json-constant`, `claude-plugin-malformed-utf8`, `claude-plugin-inconsistent-normalized-name`, `claude-plugin-vendored-scope-undeclared`, `claude-plugin-conflicting-identity`, `claude-plugin-unbounded-mcp`, `claude-plugin-license-missing`, `claude-plugin-license-mismatch`, `claude-plugin-dynamic-eval`, `claude-plugin-hidden-undeclared-executable`, `claude-plugin-concealed-identity`, `claude-plugin-oversized-package`, `claude-plugin-source-mismatch`, `claude-plugin-github-write-token`, `claude-plugin-docker-socket`, `claude-plugin-browser-profile-access`, `claude-plugin-deceptive-description`, `claude-plugin-secret-to-network`, `claude-plugin-secret-to-prompt`, `claude-plugin-secret-to-mcp`, `claude-plugin-hide-actions-directive` / `claude-plugin-self-modify-directive` / `claude-plugin-goal-escalation-directive`, `claude-plugin-setuid-executable` / `claude-plugin-world-writable-executable`, `claude-plugin-decompression-bomb`, reused #1036 `skill-name-homoglyph-confusable` / `skill-manifest-prompt-injection-payload` / `skill-doc-exfiltration-endpoint-directive` / `skill-placeholder-template-unresolved` on plugin skill/agent/command surfaces, deterministic scan receipt with catalog repository/SHA bind, SARIF 2.1.0 `sarif_sha256` bound to the same finding rule_ids, `policy_provenance` bound to the AppGuardrail release plus exact scan-policy digest, and `sbom_sha256` of a deterministic CycloneDX 1.5 document, `claude-plugin-checksum-mismatch` when a first-party SHA256SUMS or sibling `*.sha256` disagrees with bytes on disk, `claude-plugin-unsigned-checksum` when checksum digest rows have no sibling Cosign/GPG signature file, `claude-plugin-excessive-path-depth` when a materialized file or archive member nests past 32 path components, `claude-plugin-github-merge-command` for hook or manifest `gh pr merge`, `claude-plugin-github-release-command` for `gh release create|upload|delete|edit`, `claude-plugin-kubectl-apply-command` for hook or manifest `kubectl apply`, `claude-plugin-docker-push-command` for `docker push`, `claude-plugin-terraform-apply-command` for `terraform apply`, `claude-plugin-helm-install-command` for `helm install`, `claude-plugin-vercel-deploy-command` for hook or manifest `vercel deploy`, `claude-plugin-fly-deploy-command` for `fly deploy`, `claude-plugin-aws-deploy-command` for hook or manifest `aws cloudformation deploy`, `claude-plugin-gcloud-deploy-command` for `gcloud run deploy`, `claude-plugin-az-deploy-command` for `az webapp deploy`, `claude-plugin-aws-s3-write-command` for hook or manifest `aws s3 sync`/`cp`, `claude-plugin-az-containerapp-up-command` for `az containerapp up`, `claude-plugin-credential-store-access` for host cookie and token stores that are not browser profiles, fail-closed receipt verification | implemented-branch |
 | Orphaned GitHub Actions registry identities (#929) | owned by PR #966 / issue #929; live registry DAST | mapped-family only; this successor does not ship or close the detector |
 | Org security-failure CI tickets without copied vuln evidence | documented non-detectable family | snapshot in `tests/fixtures/cwl-security-issue-inventory.json` |
 
diff --git a/docs/sast-dast-rule-research.md b/docs/sast-dast-rule-research.md
index f5f0c68c..9c3f952f 100644
--- a/docs/sast-dast-rule-research.md
+++ b/docs/sast-dast-rule-research.md
@@ -109,7 +109,10 @@ files being scanned, then applies the union of relevant checks. Examples:
   `claude-plugin-fly-deploy-command` for ``fly deploy``,
   `claude-plugin-aws-deploy-command` for ``aws cloudformation deploy``,
   `claude-plugin-gcloud-deploy-command` for ``gcloud run deploy``,
-  `claude-plugin-az-deploy-command` for ``az webapp deploy``, and
+  `claude-plugin-az-deploy-command` for ``az webapp deploy``,
+  `claude-plugin-aws-s3-write-command` for ``aws s3 sync``/``cp``,
+  `claude-plugin-az-containerapp-up-command` for ``az containerapp up``,
+  and
   `claude-plugin-credential-store-access` for host ``~/.netrc``,
   ``~/.aws/credentials``, GitHub CLI hosts, Docker auth, cookie jars, and
   SSH private keys. Chrome/Firefox profile stores stay
diff --git a/tests/test_claude_plugin_cloud_deploy.py b/tests/test_claude_plugin_cloud_deploy.py
index 01fb690d..e1b948f7 100644
--- a/tests/test_claude_plugin_cloud_deploy.py
+++ b/tests/test_claude_plugin_cloud_deploy.py
@@ -196,6 +196,7 @@ def test_plugin_manifest_az_webapp_deploy_fails_admission(tmp_path: Path) -> Non
         (root / ".claude-plugin" / "plugin.json").read_text(encoding="utf-8")
     )
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [{"command": "az webapp deploy --name app"}],
     }
     _write_json(root / ".claude-plugin" / "plugin.json", manifest)
@@ -225,6 +226,7 @@ def test_manifest_cloud_prose_and_reporting_commands_are_not_this_class(
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
     manifest["description"] = "operators may later run gcloud run deploy"
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [
             {"command": 'echo "aws cloudformation deploy"'},
             {"command": "printf '%s\\n' 'az webapp deploy'"},
@@ -246,6 +248,7 @@ def test_manifest_reporting_command_does_not_hide_later_cloud_deploy(
     manifest_path = root / ".claude-plugin" / "plugin.json"
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [
             {"command": 'echo "gcloud run deploy"'},
             {"command": "aws cloudformation deploy --stack-name app"},
diff --git a/tests/test_claude_plugin_hosted_deploy.py b/tests/test_claude_plugin_hosted_deploy.py
index 4464cca0..447e0efd 100644
--- a/tests/test_claude_plugin_hosted_deploy.py
+++ b/tests/test_claude_plugin_hosted_deploy.py
@@ -251,6 +251,7 @@ def test_plugin_manifest_fly_deploy_fails_admission(tmp_path: Path) -> None:
         (root / ".claude-plugin" / "plugin.json").read_text(encoding="utf-8")
     )
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [{"command": "fly deploy --now"}],
     }
     _write_json(root / ".claude-plugin" / "plugin.json", manifest)
@@ -345,6 +346,7 @@ def test_manifest_reporting_commands_and_description_are_not_this_class(
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
     manifest["description"] = "operators may later run vercel deploy"
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [
             {"command": 'echo "fly deploy"'},
             {"command": "printf '%s\\n' 'vercel deploy'"},
@@ -368,6 +370,7 @@ def test_manifest_reporting_command_does_not_hide_later_deploy(
     manifest_path = root / ".claude-plugin" / "plugin.json"
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [
             {"command": 'echo "fly deploy"'},
             {"command": "vercel deploy --prod"},
diff --git a/tests/test_claude_plugin_object_store.py b/tests/test_claude_plugin_object_store.py
index 3e9dda14..1abce52e 100644
--- a/tests/test_claude_plugin_object_store.py
+++ b/tests/test_claude_plugin_object_store.py
@@ -161,6 +161,7 @@ def test_plugin_manifest_containerapp_up_fails_admission(tmp_path: Path) -> None
         (root / ".claude-plugin" / "plugin.json").read_text(encoding="utf-8")
     )
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [{"command": "az containerapp up --name app"}],
     }
     _write_json(root / ".claude-plugin" / "plugin.json", manifest)
@@ -177,6 +178,7 @@ def test_manifest_prose_and_reporting_are_not_this_class(tmp_path: Path) -> None
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
     manifest["description"] = "operators may later run aws s3 sync"
     manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
         "PostToolUse": [{"command": 'echo "az containerapp up"'}],
     }
     _write_json(manifest_path, manifest)

From f480ae0e9805e49f5007bbd8abd5c5cda3c9c487 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 14:10:18 +0900
Subject: [PATCH 03/12] test(scanner): distinguish s3 downloads from writes RED

---
 tests/test_claude_plugin_object_store.py | 27 +++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/tests/test_claude_plugin_object_store.py b/tests/test_claude_plugin_object_store.py
index 1abce52e..f809921f 100644
--- a/tests/test_claude_plugin_object_store.py
+++ b/tests/test_claude_plugin_object_store.py
@@ -1,4 +1,4 @@
-"""Hook aws s3 writes and az containerapp up fail closed; ls stays inventory."""
+"""Hook aws s3 writes and az containerapp up fail closed; reads stay inventory."""
 
 from __future__ import annotations
 
@@ -58,7 +58,7 @@ def _hits(root: Path, rule_id: str):
 
 
 def test_hook_aws_s3_sync_fails_admission(tmp_path: Path) -> None:
-    """``aws s3 sync`` on a hook is object-store write authority."""
+    """``aws s3 sync`` to S3 is object-store write authority."""
     root = _licensed_plugin(tmp_path, "#!/bin/sh\naws s3 sync ./dist s3://bucket/app\n")
     hits = _hits(root, _S3_RULE)
     receipt = build_claude_plugin_scan_receipt(root)
@@ -74,12 +74,33 @@ def test_hook_aws_s3_sync_fails_admission(tmp_path: Path) -> None:
 
 
 def test_hook_aws_s3_cp_fails_admission() -> None:
-    """``aws s3 cp`` is the same object-store write class."""
+    """``aws s3 cp`` to S3 is object-store write authority."""
     body = "#!/bin/sh\naws s3 cp artifact.tgz s3://bucket/app.tgz\n"
     hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
     assert any(hit.rule_id == _S3_RULE and hit.snippet == "aws s3 cp" for hit in hits)
 
 
+def test_hook_aws_s3_cp_download_stays_inventory() -> None:
+    """A provable S3-to-local copy is read authority, not this write class."""
+    body = "#!/bin/sh\naws s3 cp s3://bucket/app.tgz ./app.tgz\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert not any(hit.rule_id == _S3_RULE for hit in hits)
+
+
+def test_hook_aws_s3_sync_download_stays_inventory() -> None:
+    """A provable S3-to-local sync is read authority, not this write class."""
+    body = "#!/bin/sh\naws s3 sync s3://bucket/app ./app\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert not any(hit.rule_id == _S3_RULE for hit in hits)
+
+
+def test_hook_aws_s3_to_s3_copy_still_fails_admission() -> None:
+    """S3-to-S3 copy still writes the destination bucket."""
+    body = "#!/bin/sh\naws s3 cp s3://source/app.tgz s3://target/app.tgz\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert any(hit.rule_id == _S3_RULE for hit in hits)
+
+
 def test_hook_az_containerapp_up_fails_admission(tmp_path: Path) -> None:
     """``az containerapp up`` on a hook is Azure write authority."""
     root = _licensed_plugin(tmp_path, "#!/bin/sh\naz containerapp up --name app\n")

From 51d1da4ba25d88c5036c42d519475d8cdf871e8a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 14:20:53 +0900
Subject: [PATCH 04/12] fix(scanner): distinguish literal S3 downloads from
 writes

---
 appguardrail_core/claude_plugin_detector.py | 29 +++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index f9edabeb..546ec5c6 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -2011,6 +2011,33 @@ def _az_deploy_command_hits(
     return ()
 
 
+def _is_literal_s3_download(
+    content: str, match: re.Match[str]
+) -> bool:
+    """Return whether one direct S3 command provably reads to a local path."""
+    line_start = content.rfind("\n", 0, match.start()) + 1
+    line_end = content.find("\n", match.start())
+    if line_end < 0:
+        line_end = len(content)
+    line = content[line_start:line_end]
+    relative = match.start() - line_start
+    command_end = match.end() - line_start
+    for start, end in _iter_unquoted_segment_bounds(line):
+        if start <= relative < end:
+            operands = line[command_end:end].split()
+            return (
+                len(operands) == 2
+                and operands[0].lower().startswith("s3://")
+                and not operands[1].lower().startswith("s3://")
+                and not operands[1].startswith("-")
+                and all(
+                    re.fullmatch(r"[A-Za-z0-9._~:/+-]+", operand)
+                    for operand in operands
+                )
+            )
+    return False
+
+
 def _aws_s3_write_command_hits(
     content: str, *, manifest: bool = False
 ) -> tuple[PluginHit, ...]:
@@ -2028,6 +2055,8 @@ def _aws_s3_write_command_hits(
         match = _executable_command_match(source, _AWS_S3_WRITE_COMMAND)
         if match is None:
             continue
+        if _is_literal_s3_download(source, match):
+            continue
         verb = match.group("verb").lower()
         return (
             PluginHit(

From 44761c28d8748f63eca052ec6145be1111bc4d68 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 14:21:30 +0900
Subject: [PATCH 05/12] test(scanner): reproduce download-before-upload false
 negative

---
 tests/test_claude_plugin_object_store.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tests/test_claude_plugin_object_store.py b/tests/test_claude_plugin_object_store.py
index f809921f..6c9e2bae 100644
--- a/tests/test_claude_plugin_object_store.py
+++ b/tests/test_claude_plugin_object_store.py
@@ -219,3 +219,15 @@ def test_cloudformation_deploy_stays_the_aws_deploy_class() -> None:
     rule_ids = {hit.rule_id for hit in hits}
     assert _AWS_DEPLOY_RULE in rule_ids
     assert _THIS_CLASS.isdisjoint(rule_ids)
+
+
+def test_download_before_later_upload_still_fails_admission() -> None:
+    """A safe first command cannot hide a later S3 destination write."""
+    body = (
+        "#!/bin/sh\n"
+        "aws s3 cp s3://bucket/input.tgz ./input.tgz && "
+        "aws s3 cp ./output.tgz s3://bucket/output.tgz\n"
+    )
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert any(hit.rule_id == _S3_RULE for hit in hits)
+

From 3073ffdbbddbaa30d363f366d7dc5deea250f939 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 14:22:21 +0900
Subject: [PATCH 06/12] fix(scanner): scan past safe S3 downloads

---
 appguardrail_core/claude_plugin_detector.py | 43 +++++++++------------
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index 546ec5c6..46b3a152 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -2041,31 +2041,26 @@ def _is_literal_s3_download(
 def _aws_s3_write_command_hits(
     content: str, *, manifest: bool = False
 ) -> tuple[PluginHit, ...]:
-    """Return ``aws s3 sync``/``cp`` findings with a command label, not URIs.
-
-    Args:
-        content: Hook or manifest text.
-        manifest: When true, only structural command values are scanned.
-
-    Returns:
-        One hit for executable ``aws s3 sync`` or ``aws s3 cp``.
-        ``aws s3 ls``, comments, and echo lookalikes are not this class.
-    """
+    """Return S3-destination write findings without copying operand URIs."""
     for source, first_line in _hosted_command_sources(content, manifest=manifest):
-        match = _executable_command_match(source, _AWS_S3_WRITE_COMMAND)
-        if match is None:
-            continue
-        if _is_literal_s3_download(source, match):
-            continue
-        verb = match.group("verb").lower()
-        return (
-            PluginHit(
-                rule_id="claude-plugin-aws-s3-write-command",
-                line=first_line + source[: match.start()].count("\n"),
-                snippet="aws s3 " + verb,
-                message=CLAUDE_PLUGIN_AWS_S3_WRITE_COMMAND_MESSAGE,
-            ),
-        )
+        search_from = 0
+        while search_from < len(source):
+            fragment = source[search_from:]
+            match = _executable_command_match(fragment, _AWS_S3_WRITE_COMMAND)
+            if match is None:
+                break
+            absolute_start = search_from + match.start()
+            if not _is_literal_s3_download(fragment, match):
+                verb = match.group("verb").lower()
+                return (
+                    PluginHit(
+                        rule_id="claude-plugin-aws-s3-write-command",
+                        line=first_line + source[:absolute_start].count("\n"),
+                        snippet="aws s3 " + verb,
+                        message=CLAUDE_PLUGIN_AWS_S3_WRITE_COMMAND_MESSAGE,
+                    ),
+                )
+            search_from += match.end()
     return ()
 
 

From 7f30f705e36cc127b4825948ec00481b5de12720 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 16:12:08 +0900
Subject: [PATCH 07/12] fix(scanner): inherit quoted command-context repair

---
 appguardrail_core/claude_plugin_detector.py | 84 ++++++++++++++++++---
 1 file changed, 74 insertions(+), 10 deletions(-)

diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index 46b3a152..b0877d53 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -1860,14 +1860,73 @@ def _hosted_command_sources(
     return ((content, 1),)
 
 
+def _shell_command_context_start(line: str, offset: int) -> int | None:
+    """Return the executable shell-frame start containing ``offset``.
+
+    Args:
+        line: One hook or manifest command line.
+        offset: Zero-based match offset within ``line``.
+
+    Returns:
+        The start of the root, ``$(...)``, or backtick command frame.
+        ``None`` means the offset is inert single- or double-quoted prose.
+    """
+    frames: list[tuple[str, int, str, int]] = [("", 0, "", 0)]
+    escaped = False
+    index = 0
+    while index < offset:
+        frame_end, frame_start, quote, depth = frames[-1]
+        char = line[index]
+        if escaped:
+            escaped = False
+            index += 1
+            continue
+        if char == "\\" and quote != "'":
+            escaped = True
+            index += 1
+            continue
+        if char == "'" and quote != '"':
+            frames[-1] = (frame_end, frame_start, "" if quote == "'" else "'", depth)
+            index += 1
+            continue
+        if char == '"' and quote != "'":
+            frames[-1] = (frame_end, frame_start, "" if quote == '"' else '"', depth)
+            index += 1
+            continue
+        if quote != "'" and line[index : index + 2] == "$(":
+            frames.append((")", index + 2, "", 1))
+            index += 2
+            continue
+        if quote != "'" and char == "`":
+            if frame_end == "`":
+                frames.pop()
+            else:
+                frames.append(("`", index + 1, "", 0))
+            index += 1
+            continue
+        if quote:
+            index += 1
+            continue
+        if frame_end == ")" and char == "(":
+            frames[-1] = (frame_end, frame_start, quote, depth + 1)
+        elif frame_end == ")" and char == ")":
+            if depth == 1:
+                frames.pop()
+            else:
+                frames[-1] = (frame_end, frame_start, quote, depth - 1)
+        index += 1
+    _frame_end, frame_start, quote, _depth = frames[-1]
+    return None if quote else frame_start
+
+
 def _executable_command_match(
     content: str, pattern: re.Pattern[str]
 ) -> re.Match[str] | None:
     """Return the first regex match that is an executable command context.
 
-    Unquoted ``#`` comments and ``echo``/``printf``/``print`` segments are
-    not executable. Manifest JSON command strings remain searchable
-    because they are not reporting builtins.
+    Unquoted ``#`` comments, quoted prose, and
+    ``echo``/``printf``/``print`` segments are not executable. Direct
+    commands inside ``$(...)`` or backticks remain executable.
 
     Args:
         content: Hook or manifest text.
@@ -1885,17 +1944,22 @@ def _executable_command_match(
             line_end = len(content)
         line = content[line_start:line_end]
         relative = match.start() - line_start
-        comment_at = _unquoted_hash_index(line)
-        if comment_at is not None and relative >= comment_at:
+        context_start = _shell_command_context_start(line, relative)
+        if context_start is None:
             continue
-        for start, end in _iter_unquoted_segment_bounds(line):
-            if start <= relative < end:
-                if not _is_reporting_builtin_segment(line[start:end]):
+        context = line[context_start:]
+        context_relative = relative - context_start
+        comment_at = _unquoted_hash_index(context)
+        if comment_at is not None and context_relative >= comment_at:
+            continue
+        for segment_start, segment_end in _iter_unquoted_segment_bounds(context):
+            if segment_start <= context_relative < segment_end:
+                if not _is_reporting_builtin_segment(
+                    context[segment_start:segment_end]
+                ):
                     return match
                 break
     return None
-
-
 def _vercel_deploy_command_hits(
     content: str, *, manifest: bool = False
 ) -> tuple[PluginHit, ...]:

From f130c2cdc023827cddd2364039753d84ad801cd9 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 16:12:09 +0900
Subject: [PATCH 08/12] test(scanner): inherit quoted command-context
 regressions

---
 tests/test_claude_plugin_terraform_helm.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/test_claude_plugin_terraform_helm.py b/tests/test_claude_plugin_terraform_helm.py
index 4a95efdf..d413aa2c 100644
--- a/tests/test_claude_plugin_terraform_helm.py
+++ b/tests/test_claude_plugin_terraform_helm.py
@@ -254,3 +254,25 @@ def test_later_executable_command_after_reporting_segment_still_fails() -> None:
         hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
         assert any(hit.rule_id in _THIS_CLASS for hit in hits)
 
+def test_quoted_shell_prose_is_not_executable() -> None:
+    """Quoted command names and reporting substitutions are inert prose."""
+    bodies = (
+        '#!/bin/sh\nmessage="terraform apply -auto-approve"\n',
+        '#!/bin/sh\nif [ "$mode" = "helm install app chart/" ]; then echo safe; fi\n',
+        "#!/bin/sh\nmessage='helm install app chart/'\n",
+        '#!/bin/sh\nresult="$(echo \'terraform apply -auto-approve\')"\n',
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert _THIS_CLASS.isdisjoint(hit.rule_id for hit in hits)
+
+
+def test_command_substitution_remains_executable() -> None:
+    """Direct commands in modern and legacy substitutions remain executable."""
+    bodies = (
+        '#!/bin/sh\nresult="$(terraform apply -auto-approve)"\n',
+        "#!/bin/sh\nresult=`helm install app chart/`\n",
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert any(hit.rule_id in _THIS_CLASS for hit in hits)

From 097b6dddfdba7ea2a8cd069942f6371c269e0e6a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 16:37:18 +0900
Subject: [PATCH 09/12] test(scanner): inherit assignment command boundary

---
 tests/test_claude_plugin_terraform_helm.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/test_claude_plugin_terraform_helm.py b/tests/test_claude_plugin_terraform_helm.py
index d413aa2c..b80b6877 100644
--- a/tests/test_claude_plugin_terraform_helm.py
+++ b/tests/test_claude_plugin_terraform_helm.py
@@ -276,3 +276,25 @@ def test_command_substitution_remains_executable() -> None:
     for body in bodies:
         hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
         assert any(hit.rule_id in _THIS_CLASS for hit in hits)
+
+
+def test_assignment_values_are_not_executable_commands() -> None:
+    """An unquoted assignment value cannot turn its following word into the CLI."""
+    bodies = (
+        "#!/bin/sh\nmessage=terraform apply -auto-approve\n",
+        "#!/bin/sh\ncommand=helm install app chart/\n",
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert _THIS_CLASS.isdisjoint(hit.rule_id for hit in hits)
+
+
+def test_environment_assignment_before_real_command_still_fails() -> None:
+    """Environment assignments do not hide a later executable deployment CLI."""
+    bodies = (
+        "#!/bin/sh\nTF_IN_AUTOMATION=1 terraform apply -auto-approve\n",
+        "#!/bin/sh\nHELM_NAMESPACE=prod helm install app chart/\n",
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert any(hit.rule_id in _THIS_CLASS for hit in hits)

From 5e8b1987daf52466aeb1c3877bcc95cfd59c046f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 16:37:19 +0900
Subject: [PATCH 10/12] fix(scanner): inherit assignment command boundary

---
 appguardrail_core/claude_plugin_detector.py | 28 ++++++++++++++++++---
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index b0877d53..cc0bcf82 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -1919,12 +1919,28 @@ def _shell_command_context_start(line: str, offset: int) -> int | None:
     return None if quote else frame_start
 
 
-def _executable_command_match(
-    content: str, pattern: re.Pattern[str]
+def _match_starts_in_shell_assignment_value(segment: str, offset: int) -> bool:
+    """Return whether ``offset`` starts inside an unquoted assignment word.
+
+    Args:
+        segment: One shell command segment.
+        offset: Zero-based match offset within ``segment``.
+
+    Returns:
+        True when the current shell word before ``offset`` contains ``=``.
+        An assignment followed by whitespace and a real command returns False.
+    """
+    prefix = segment[:offset]
+    if not prefix or prefix[-1].isspace():
+        return False
+    return "=" in prefix.rsplit(maxsplit=1)[-1]
+
+
+def _executable_command_match(    content: str, pattern: re.Pattern[str]
 ) -> re.Match[str] | None:
     """Return the first regex match that is an executable command context.
 
-    Unquoted ``#`` comments, quoted prose, and
+    Unquoted ``#`` comments, quoted prose, shell assignment values, and
     ``echo``/``printf``/``print`` segments are not executable. Direct
     commands inside ``$(...)`` or backticks remain executable.
 
@@ -1954,8 +1970,12 @@ def _executable_command_match(
             continue
         for segment_start, segment_end in _iter_unquoted_segment_bounds(context):
             if segment_start <= context_relative < segment_end:
+                segment = context[segment_start:segment_end]
+                segment_relative = context_relative - segment_start
                 if not _is_reporting_builtin_segment(
-                    context[segment_start:segment_end]
+                    segment
+                ) and not _match_starts_in_shell_assignment_value(
+                    segment, segment_relative
                 ):
                     return match
                 break

From f5dd35dccb205054c310724e3590d4e47614a10a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 17:14:39 +0900
Subject: [PATCH 11/12] fix(scanner): carry heredoc command boundary

---
 appguardrail_core/claude_plugin_detector.py | 57 ++++++++++++++++++++-
 1 file changed, 55 insertions(+), 2 deletions(-)

diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index cc0bcf82..4f29e0cd 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -450,6 +450,11 @@
 )
 _REPORTING_BUILTINS: Final = frozenset({"echo", "printf", "print"})
 _FIRST_SHELL_TOKEN = re.compile(r"\s*([A-Za-z0-9_./+-]+)")
+_LITERAL_HEREDOC_OPEN = re.compile(
+    r"<<(?P<strip>-)?[ \t]*(?P<quote>['\"]?)"
+    r"(?P<delimiter>[A-Za-z_][A-Za-z0-9_]*)(?P=quote)"
+    r"(?=$|[ \t;&|()<>])"
+)
 _DOCKER_SOCKET = re.compile(
     r"(?:/var/run/docker\.sock|unix://\S*docker\.sock)",
     re.IGNORECASE,
@@ -1919,6 +1924,50 @@ def _shell_command_context_start(line: str, offset: int) -> int | None:
     return None if quote else frame_start
 
 
+def _literal_heredoc_payload_spans(content: str) -> tuple[tuple[int, int], ...]:
+    """Return closed literal here-document payload spans.
+
+    Args:
+        content: One hook or structural manifest command string.
+
+    Returns:
+        Inclusive-start exclusive-end spans for payloads with one confidently
+        parsed identifier delimiter on the opener line. Quoted delimiters and
+        tab-stripping forms are supported. Ambiguous or unclosed forms stay
+        executable for fail-closed analysis.
+    """
+    spans: list[tuple[int, int]] = []
+    active: tuple[str, bool, int] | None = None
+    offset = 0
+    for raw_line in content.splitlines(keepends=True):
+        line = raw_line.rstrip("\r\n")
+        if active is not None:
+            delimiter, strip_tabs, payload_start = active
+            candidate = line.lstrip("\t") if strip_tabs else line
+            if candidate == delimiter:
+                spans.append((payload_start, offset))
+                active = None
+            offset += len(raw_line)
+            continue
+
+        comment_at = _unquoted_hash_index(line)
+        openers = tuple(
+            match
+            for match in _LITERAL_HEREDOC_OPEN.finditer(line)
+            if (comment_at is None or match.start() < comment_at)
+            and _shell_command_context_start(line, match.start()) is not None
+        )
+        if len(openers) == 1:
+            opener = openers[0]
+            active = (
+                opener.group("delimiter"),
+                opener.group("strip") is not None,
+                offset + len(raw_line),
+            )
+        offset += len(raw_line)
+    return tuple(spans)
+
+
 def _match_starts_in_shell_assignment_value(segment: str, offset: int) -> bool:
     """Return whether ``offset`` starts inside an unquoted assignment word.
 
@@ -1940,8 +1989,9 @@ def _executable_command_match(    content: str, pattern: re.Pattern[str]
 ) -> re.Match[str] | None:
     """Return the first regex match that is an executable command context.
 
-    Unquoted ``#`` comments, quoted prose, shell assignment values, and
-    ``echo``/``printf``/``print`` segments are not executable. Direct
+    Unquoted ``#`` comments, quoted prose, closed literal here-document
+    payloads, shell assignment values, and ``echo``/``printf``/``print``
+    segments are not executable. Direct
     commands inside ``$(...)`` or backticks remain executable.
 
     Args:
@@ -1953,7 +2003,10 @@ def _executable_command_match(    content: str, pattern: re.Pattern[str]
     """
     if not content:
         return None
+    inert_payloads = _literal_heredoc_payload_spans(content)
     for match in pattern.finditer(content):
+        if any(start <= match.start() < end for start, end in inert_payloads):
+            continue
         line_start = content.rfind("\n", 0, match.start()) + 1
         line_end = content.find("\n", match.start())
         if line_end < 0:

From e527fd2404db812c7f51ed557c9b9109191fc5df Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 8 Sep 2026 17:14:40 +0900
Subject: [PATCH 12/12] test(scanner): carry heredoc command regressions

---
 tests/test_claude_plugin_terraform_helm.py | 37 ++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tests/test_claude_plugin_terraform_helm.py b/tests/test_claude_plugin_terraform_helm.py
index b80b6877..fe3bc41e 100644
--- a/tests/test_claude_plugin_terraform_helm.py
+++ b/tests/test_claude_plugin_terraform_helm.py
@@ -212,6 +212,7 @@ def test_kubectl_apply_without_terraform_stays_the_kubectl_class() -> None:
     assert _KUBECTL_RULE in rule_ids
     assert _THIS_CLASS.isdisjoint(rule_ids)
 
+
 def test_hook_comments_and_reporting_builtins_are_not_commands() -> None:
     """Comments and reporting builtins do not execute terraform or Helm."""
     bodies = (
@@ -278,6 +279,7 @@ def test_command_substitution_remains_executable() -> None:
         assert any(hit.rule_id in _THIS_CLASS for hit in hits)
 
 
+
 def test_assignment_values_are_not_executable_commands() -> None:
     """An unquoted assignment value cannot turn its following word into the CLI."""
     bodies = (
@@ -298,3 +300,38 @@ def test_environment_assignment_before_real_command_still_fails() -> None:
     for body in bodies:
         hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
         assert any(hit.rule_id in _THIS_CLASS for hit in hits)
+
+
+def test_here_document_payload_is_not_an_executable_command() -> None:
+    """Literal here-document payload is data, even when it names deployment CLIs."""
+    bodies = (
+        "#!/bin/sh\ncat <<'EOF'\nterraform apply -auto-approve\nEOF\n",
+        "#!/bin/sh\ncat <<-EOF\n\thelm install app chart/\n\tEOF\n",
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert _THIS_CLASS.isdisjoint(hit.rule_id for hit in hits)
+
+
+def test_command_after_here_document_still_fails() -> None:
+    """An inert payload cannot hide a later executable deployment command."""
+    body = (
+        "#!/bin/sh\ncat <<'EOF'\nterraform apply -auto-approve\nEOF\n"
+        "helm install app chart/\n"
+    )
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    rule_ids = {hit.rule_id for hit in hits}
+    assert _TERRAFORM_RULE not in rule_ids
+    assert _HELM_RULE in rule_ids
+
+
+def test_heredoc_opener_lookalikes_do_not_hide_real_commands() -> None:
+    """Quoted or commented opener text cannot suppress a later real command."""
+    bodies = (
+        '#!/bin/sh\necho "<<EOF"\nterraform apply -auto-approve\n',
+        "#!/bin/sh\n# cat <<EOF\nhelm install app chart/\n",
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert any(hit.rule_id in _THIS_CLASS for hit in hits)
+