diff --git a/CHANGELOG.d/1099-claude-plugin-supply-chain.md b/CHANGELOG.d/1099-claude-plugin-supply-chain.md
index 38811263..e7a1794a 100644
--- a/CHANGELOG.d/1099-claude-plugin-supply-chain.md
+++ b/CHANGELOG.d/1099-claude-plugin-supply-chain.md
@@ -166,13 +166,16 @@
   fail as `claude-plugin-pub-publish-command`. ``hex publish`` and
   ``mix hex.publish`` fail as `claude-plugin-hex-publish-command`.
   ``conda upload`` and ``anaconda upload`` fail as
-  `claude-plugin-conda-upload-command`.
+  `claude-plugin-conda-upload-command`. ``cabal upload`` and
+  ``cabal v2-upload`` fail as `claude-plugin-cabal-upload-command`.
+  ``mvn deploy`` fails as `claude-plugin-mvn-deploy-command`.
   Hook comments and
   ``echo``/``printf`` lookalikes are not those classes.
   ``terraform plan``, ``helm list``,
   ``vercel ls``, ``fly status``, ``aws s3 ls``, ``gcloud config list``,
   ``az account show``, ``npm pack``, ``cargo check``, ``gem list``,
-  ``nuget list``, ``hex info``, and ``conda list``
+  ``nuget list``, ``hex info``, ``conda list``, ``cabal list``, and
+  ``mvn package``
   stay inventory. Hardcoded
   PATs stay `claude-plugin-github-write-token`. Snippets are command
   labels, not tokens.
diff --git a/appguardrail_core/claude_plugin_detector.py b/appguardrail_core/claude_plugin_detector.py
index 7c1ba18e..786d0ea9 100644
--- a/appguardrail_core/claude_plugin_detector.py
+++ b/appguardrail_core/claude_plugin_detector.py
@@ -373,6 +373,16 @@
     "package is write authority on Anaconda.org. Remove the command. "
     "[CWE-250 - Execution with Unnecessary Privileges]"
 )
+CLAUDE_PLUGIN_CABAL_UPLOAD_COMMAND_MESSAGE: Final = (
+    "Claude plugin hook or manifest runs cabal upload. Publishing a "
+    "package is write authority on Hackage. Remove the command. "
+    "[CWE-269 - Improper Privilege Management]"
+)
+CLAUDE_PLUGIN_MVN_DEPLOY_COMMAND_MESSAGE: Final = (
+    "Claude plugin hook or manifest runs mvn deploy. Publishing a "
+    "package is write authority on a Maven repository. Remove the command. "
+    "[CWE-250 - Execution with Unnecessary Privileges]"
+)
 CLAUDE_PLUGIN_DOCKER_SOCKET_MESSAGE: Final = (
     "Claude plugin hook reaches the host Docker socket. Socket access is host "
     "control, not an image push. Remove the socket bind and keep builds "
@@ -536,6 +546,14 @@
     r"\b(?P<cli>conda|anaconda)\s+upload\b",
     re.IGNORECASE,
 )
+_CABAL_UPLOAD_COMMAND = re.compile(
+    r"\bcabal\s+(?P<verb>(?:v2-)?upload)\b",
+    re.IGNORECASE,
+)
+_MVN_DEPLOY_COMMAND = re.compile(
+    r"\bmvn\s+deploy\b",
+    re.IGNORECASE,
+)
 _REPORTING_BUILTINS: Final = frozenset({"echo", "printf", "print"})
 _FIRST_SHELL_TOKEN = re.compile(r"\s*([A-Za-z0-9_./+-]+)")
 _LITERAL_HEREDOC_OPEN = re.compile(
@@ -827,7 +845,9 @@
             r"(?:dotnet\s+)?nuget\s+push|"
             r"(?:dart\s+|flutter\s+)?pub\s+publish|"
             r"mix\s+hex\.publish|hex\s+publish|"
-            r"(?:conda|anaconda)\s+upload)\b",
+            r"(?:conda|anaconda)\s+upload|"
+            r"cabal\s+(?:v2-)?upload|"
+            r"mvn\s+deploy)\b",
             re.IGNORECASE,
         ),
     ),
@@ -1058,6 +1078,8 @@ def inspect_claude_plugin_file(
         hits.extend(_pub_publish_command_hits(content, manifest=manifest))
         hits.extend(_hex_publish_command_hits(content, manifest=manifest))
         hits.extend(_conda_upload_command_hits(content, manifest=manifest))
+        hits.extend(_cabal_upload_command_hits(content, manifest=manifest))
+        hits.extend(_mvn_deploy_command_hits(content, manifest=manifest))
         hits.extend(_docker_socket_hits(content))
         hits.extend(_browser_profile_hits(content))
         hits.extend(_credential_store_hits(content))
@@ -2654,6 +2676,64 @@ def _conda_upload_command_hits(
     return ()
 
 
+def _cabal_upload_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return ``cabal upload`` findings with a command label, not package names.
+
+    Args:
+        content: Hook or manifest text.
+        manifest: When true, only structural command values are scanned.
+
+    Returns:
+        One hit for executable ``cabal upload`` or ``cabal v2-upload``.
+        ``cabal list`` is not this class. ``hex publish`` stays the
+        Hex.pm class.
+    """
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _CABAL_UPLOAD_COMMAND)
+        if match is None:
+            continue
+        snippet = "cabal " + match.group("verb").lower()
+        return (
+            PluginHit(
+                rule_id="claude-plugin-cabal-upload-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet=snippet,
+                message=CLAUDE_PLUGIN_CABAL_UPLOAD_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
+def _mvn_deploy_command_hits(
+    content: str, *, manifest: bool = False
+) -> tuple[PluginHit, ...]:
+    """Return ``mvn deploy`` findings with a command label, not artifact names.
+
+    Args:
+        content: Hook or manifest text.
+        manifest: When true, only structural command values are scanned.
+
+    Returns:
+        One hit for executable ``mvn deploy`` or ``mvn deploy:deploy-file``.
+        ``mvn package`` is not this class.
+    """
+    for source, first_line in _hosted_command_sources(content, manifest=manifest):
+        match = _executable_command_match(source, _MVN_DEPLOY_COMMAND)
+        if match is None:
+            continue
+        return (
+            PluginHit(
+                rule_id="claude-plugin-mvn-deploy-command",
+                line=first_line + source[: match.start()].count("\n"),
+                snippet="mvn deploy",
+                message=CLAUDE_PLUGIN_MVN_DEPLOY_COMMAND_MESSAGE,
+            ),
+        )
+    return ()
+
+
 def _dynamic_eval_hits(content: str) -> tuple[PluginHit, ...]:
     """Return findings for eval/exec/compile/Function on hook surfaces."""
     match = _DYNAMIC_EVAL.search(content)
diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
index 2ab55c2c..0f3a915b 100644
--- a/docs/TRACEABILITY.md
+++ b/docs/TRACEABILITY.md
@@ -22,7 +22,7 @@
 | structural Semgrep-style `pattern:` execution by lightweight engine | built-in scanner | not implemented unless a real structural matcher is added; fixtures are not execution |
 | GitHub Actions transport-only polling loop (#1087, #938 vertical slice) | owned by PR #1088 / issue #1087; YAML rules and RED precision contracts | mapped-family only; this successor does not ship or close the detector |
 | Password/database-url/auth-comment precision and test-file context (#1106) | existing `_scan_file` rules `hardcoded-password`, `hardcoded-database-url`, `todo-skip-auth`, `_finding_context` | implemented-branch regression lock |
-| Claude plugin marketplace/package supply chain (#1099) | `claude-plugin-floating-git-ref`, `claude-plugin-provider-secret`, `claude-plugin-pipe-to-shell`, `claude-plugin-unsigned-executable-download` (hooks and package.json lifecycle scripts), `claude-plugin-unpinned-package-install`, `claude-plugin-undeclared-executable`, `claude-plugin-symlink-escape`, `claude-plugin-archive-path-traversal`, `claude-plugin-unadmitted-submodule`, `claude-plugin-duplicate-json-member`, `claude-plugin-nonstandard-json-constant`, `claude-plugin-malformed-utf8`, `claude-plugin-inconsistent-normalized-name`, `claude-plugin-vendored-scope-undeclared`, `claude-plugin-conflicting-identity`, `claude-plugin-unbounded-mcp`, `claude-plugin-license-missing`, `claude-plugin-license-mismatch`, `claude-plugin-dynamic-eval`, `claude-plugin-hidden-undeclared-executable`, `claude-plugin-concealed-identity`, `claude-plugin-oversized-package`, `claude-plugin-source-mismatch`, `claude-plugin-github-write-token`, `claude-plugin-docker-socket`, `claude-plugin-browser-profile-access`, `claude-plugin-deceptive-description`, `claude-plugin-secret-to-network`, `claude-plugin-secret-to-prompt`, `claude-plugin-secret-to-mcp`, `claude-plugin-hide-actions-directive` / `claude-plugin-self-modify-directive` / `claude-plugin-goal-escalation-directive`, `claude-plugin-setuid-executable` / `claude-plugin-world-writable-executable`, `claude-plugin-decompression-bomb`, reused #1036 `skill-name-homoglyph-confusable` / `skill-manifest-prompt-injection-payload` / `skill-doc-exfiltration-endpoint-directive` / `skill-placeholder-template-unresolved` on plugin skill/agent/command surfaces, deterministic scan receipt with catalog repository/SHA bind, SARIF 2.1.0 `sarif_sha256` bound to the same finding rule_ids, `policy_provenance` bound to the AppGuardrail release plus exact scan-policy digest, and `sbom_sha256` of a deterministic CycloneDX 1.5 document, `claude-plugin-checksum-mismatch` when a first-party SHA256SUMS or sibling `*.sha256` disagrees with bytes on disk, `claude-plugin-unsigned-checksum` when checksum digest rows have no sibling Cosign/GPG signature file, `claude-plugin-excessive-path-depth` when a materialized file or archive member nests past 32 path components, `claude-plugin-github-merge-command` for hook or manifest `gh pr merge`, `claude-plugin-github-release-command` for `gh release create|upload|delete|edit`, `claude-plugin-kubectl-apply-command` for hook or manifest `kubectl apply`, `claude-plugin-docker-push-command` for `docker push`, `claude-plugin-terraform-apply-command` for `terraform apply`, `claude-plugin-helm-install-command` for `helm install`, `claude-plugin-vercel-deploy-command` for hook or manifest `vercel deploy`, `claude-plugin-fly-deploy-command` for `fly deploy`, `claude-plugin-aws-deploy-command` for hook or manifest `aws cloudformation deploy`, `claude-plugin-gcloud-deploy-command` for `gcloud run deploy`, `claude-plugin-az-deploy-command` for `az webapp deploy`, `claude-plugin-aws-s3-write-command` for hook or manifest `aws s3 sync`/`cp`, `claude-plugin-az-containerapp-up-command` for `az containerapp up`, `claude-plugin-npm-publish-command` for hook or manifest `npm publish`, `claude-plugin-pypi-upload-command` for `twine upload`, `claude-plugin-cargo-publish-command` for `cargo publish`, `claude-plugin-pnpm-publish-command` for `pnpm publish`, `claude-plugin-uv-publish-command` for `uv publish`, `claude-plugin-poetry-publish-command` for `poetry publish`, `claude-plugin-gem-push-command` for hook or manifest `gem push`, `claude-plugin-nuget-push-command` for `nuget push`, `claude-plugin-pub-publish-command` for `dart pub publish`/`flutter pub publish`, `claude-plugin-hex-publish-command` for `hex publish`/`mix hex.publish`, `claude-plugin-conda-upload-command` for `conda upload`/`anaconda upload`, `claude-plugin-credential-store-access` for host cookie and token stores that are not browser profiles, fail-closed receipt verification | implemented-branch |
+| Claude plugin marketplace/package supply chain (#1099) | `claude-plugin-floating-git-ref`, `claude-plugin-provider-secret`, `claude-plugin-pipe-to-shell`, `claude-plugin-unsigned-executable-download` (hooks and package.json lifecycle scripts), `claude-plugin-unpinned-package-install`, `claude-plugin-undeclared-executable`, `claude-plugin-symlink-escape`, `claude-plugin-archive-path-traversal`, `claude-plugin-unadmitted-submodule`, `claude-plugin-duplicate-json-member`, `claude-plugin-nonstandard-json-constant`, `claude-plugin-malformed-utf8`, `claude-plugin-inconsistent-normalized-name`, `claude-plugin-vendored-scope-undeclared`, `claude-plugin-conflicting-identity`, `claude-plugin-unbounded-mcp`, `claude-plugin-license-missing`, `claude-plugin-license-mismatch`, `claude-plugin-dynamic-eval`, `claude-plugin-hidden-undeclared-executable`, `claude-plugin-concealed-identity`, `claude-plugin-oversized-package`, `claude-plugin-source-mismatch`, `claude-plugin-github-write-token`, `claude-plugin-docker-socket`, `claude-plugin-browser-profile-access`, `claude-plugin-deceptive-description`, `claude-plugin-secret-to-network`, `claude-plugin-secret-to-prompt`, `claude-plugin-secret-to-mcp`, `claude-plugin-hide-actions-directive` / `claude-plugin-self-modify-directive` / `claude-plugin-goal-escalation-directive`, `claude-plugin-setuid-executable` / `claude-plugin-world-writable-executable`, `claude-plugin-decompression-bomb`, reused #1036 `skill-name-homoglyph-confusable` / `skill-manifest-prompt-injection-payload` / `skill-doc-exfiltration-endpoint-directive` / `skill-placeholder-template-unresolved` on plugin skill/agent/command surfaces, deterministic scan receipt with catalog repository/SHA bind, SARIF 2.1.0 `sarif_sha256` bound to the same finding rule_ids, `policy_provenance` bound to the AppGuardrail release plus exact scan-policy digest, and `sbom_sha256` of a deterministic CycloneDX 1.5 document, `claude-plugin-checksum-mismatch` when a first-party SHA256SUMS or sibling `*.sha256` disagrees with bytes on disk, `claude-plugin-unsigned-checksum` when checksum digest rows have no sibling Cosign/GPG signature file, `claude-plugin-excessive-path-depth` when a materialized file or archive member nests past 32 path components, `claude-plugin-github-merge-command` for hook or manifest `gh pr merge`, `claude-plugin-github-release-command` for `gh release create|upload|delete|edit`, `claude-plugin-kubectl-apply-command` for hook or manifest `kubectl apply`, `claude-plugin-docker-push-command` for `docker push`, `claude-plugin-terraform-apply-command` for `terraform apply`, `claude-plugin-helm-install-command` for `helm install`, `claude-plugin-vercel-deploy-command` for hook or manifest `vercel deploy`, `claude-plugin-fly-deploy-command` for `fly deploy`, `claude-plugin-aws-deploy-command` for hook or manifest `aws cloudformation deploy`, `claude-plugin-gcloud-deploy-command` for `gcloud run deploy`, `claude-plugin-az-deploy-command` for `az webapp deploy`, `claude-plugin-aws-s3-write-command` for hook or manifest `aws s3 sync`/`cp`, `claude-plugin-az-containerapp-up-command` for `az containerapp up`, `claude-plugin-npm-publish-command` for hook or manifest `npm publish`, `claude-plugin-pypi-upload-command` for `twine upload`, `claude-plugin-cargo-publish-command` for `cargo publish`, `claude-plugin-pnpm-publish-command` for `pnpm publish`, `claude-plugin-uv-publish-command` for `uv publish`, `claude-plugin-poetry-publish-command` for `poetry publish`, `claude-plugin-gem-push-command` for hook or manifest `gem push`, `claude-plugin-nuget-push-command` for `nuget push`, `claude-plugin-pub-publish-command` for `dart pub publish`/`flutter pub publish`, `claude-plugin-hex-publish-command` for `hex publish`/`mix hex.publish`, `claude-plugin-conda-upload-command` for `conda upload`/`anaconda upload`, `claude-plugin-cabal-upload-command` for `cabal upload`/`cabal v2-upload`, `claude-plugin-mvn-deploy-command` for `mvn deploy`, `claude-plugin-credential-store-access` for host cookie and token stores that are not browser profiles, fail-closed receipt verification | implemented-branch |
 | Orphaned GitHub Actions registry identities (#929) | owned by PR #966 / issue #929; live registry DAST | mapped-family only; this successor does not ship or close the detector |
 | Org security-failure CI tickets without copied vuln evidence | documented non-detectable family | snapshot in `tests/fixtures/cwl-security-issue-inventory.json` |
 
diff --git a/docs/sast-dast-rule-research.md b/docs/sast-dast-rule-research.md
index a36a3729..10509b24 100644
--- a/docs/sast-dast-rule-research.md
+++ b/docs/sast-dast-rule-research.md
@@ -123,6 +123,8 @@ files being scanned, then applies the union of relevant checks. Examples:
   `claude-plugin-pub-publish-command` for ``dart pub publish``,
   `claude-plugin-hex-publish-command` for ``hex publish``,
   `claude-plugin-conda-upload-command` for ``conda upload``,
+  `claude-plugin-cabal-upload-command` for ``cabal upload``,
+  `claude-plugin-mvn-deploy-command` for ``mvn deploy``,
   and
   `claude-plugin-credential-store-access` for host ``~/.netrc``,
   ``~/.aws/credentials``, GitHub CLI hosts, Docker auth, cookie jars, and
@@ -132,7 +134,8 @@ files being scanned, then applies the union of relevant checks. Examples:
   ``kubectl get``, ``docker ps``, ``terraform plan``, ``helm list``,
   ``vercel ls``, ``fly status``, ``aws s3 ls``, ``gcloud config list``,
   ``az account show``, ``npm pack``, ``cargo check``, ``gem list``,
-  ``nuget list``, ``hex info``, and ``conda list`` stay inventory.
+  ``nuget list``, ``hex info``, ``conda list``, ``cabal list``, and
+  ``mvn package`` stay inventory.
 - Mapped, not owned here: GitHub Actions transport-only poll loops (#1087,
   PR #1088) and orphaned workflow registry DAST (#929, PR #966).
 - `tool-execute-parameters-passthrough`: Strix-observed dynamic tool execution
diff --git a/tests/test_claude_plugin_cabal_mvn.py b/tests/test_claude_plugin_cabal_mvn.py
new file mode 100644
index 00000000..036b22d9
--- /dev/null
+++ b/tests/test_claude_plugin_cabal_mvn.py
@@ -0,0 +1,244 @@
+"""Hook cabal upload and mvn deploy fail closed; list/package stay inventory."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from appguardrail_core.claude_plugin_detector import (
+    _collect_plugin_hits,
+    build_claude_plugin_scan_receipt,
+    inspect_claude_plugin_file,
+    inventory_claude_plugin_capabilities,
+)
+
+
+_PINNED_COMMIT = "a727be1c7bd6064419b6f60d71993a19198adc17"
+_CABAL_RULE = "claude-plugin-cabal-upload-command"
+_MVN_RULE = "claude-plugin-mvn-deploy-command"
+_HEX_RULE = "claude-plugin-hex-publish-command"
+_SECRET = "sk-cabal-must-not-leak"
+_BIDI = "\u202e"
+_THIS_CLASS = frozenset({_CABAL_RULE, _MVN_RULE})
+
+
+def _write_json(path: Path, payload: dict) -> None:
+    """Write one JSON document under ``path``."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
+
+
+def _licensed_plugin(root: Path, hook_body: str = "#!/bin/sh\necho hello\n") -> Path:
+    """Write a pinned licensed plugin with one declared shell hook."""
+    _write_json(
+        root / ".claude-plugin" / "plugin.json",
+        {
+            "name": "safe-plugin",
+            "version": "1.0.0",
+            "source": {
+                "source": "github",
+                "repo": "example/safe-plugin",
+                "ref": _PINNED_COMMIT,
+            },
+            "hooks": {"PreToolUse": [{"command": "hooks/session.sh"}]},
+        },
+    )
+    hook = root / "hooks" / "session.sh"
+    hook.parent.mkdir(parents=True, exist_ok=True)
+    hook.write_text(hook_body, encoding="utf-8")
+    hook.chmod(0o755)
+    (root / "LICENSE").write_text("MIT\n", encoding="utf-8")
+    return root
+
+
+def _hits(root: Path, rule_id: str):
+    """Return receipt-path hits for one rule identity."""
+    return [hit for hit in _collect_plugin_hits(root) if hit.rule_id == rule_id]
+
+
+def test_hook_cabal_upload_fails_admission(tmp_path: Path) -> None:
+    """``cabal upload`` on a hook is Hackage write authority."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\ncabal upload dist/app-1.0.0.tar.gz\n")
+    hits = _hits(root, _CABAL_RULE)
+    receipt = build_claude_plugin_scan_receipt(root)
+    inventory = inventory_claude_plugin_capabilities(root)
+
+    assert hits
+    assert all(hit.snippet == "cabal upload" for hit in hits)
+    assert receipt.scan_result == "fail"
+    assert _CABAL_RULE in receipt.finding_summary
+    assert _MVN_RULE not in receipt.finding_summary
+    assert _HEX_RULE not in receipt.finding_summary
+    assert inventory["package_install"] is True
+
+
+def test_cabal_v2_upload_is_the_same_class() -> None:
+    """``cabal v2-upload`` is the Cabal 3 spelling of the Hackage class."""
+    body = "#!/bin/sh\ncabal v2-upload dist/app-1.0.0.tar.gz\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert any(
+        hit.rule_id == _CABAL_RULE and hit.snippet == "cabal v2-upload" for hit in hits
+    )
+
+
+def test_hook_mvn_deploy_fails_admission(tmp_path: Path) -> None:
+    """``mvn deploy`` on a hook is Maven repository write authority."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\nmvn deploy -DskipTests\n")
+    hits = _hits(root, _MVN_RULE)
+    receipt = build_claude_plugin_scan_receipt(root)
+
+    assert hits
+    assert all(hit.snippet == "mvn deploy" for hit in hits)
+    assert receipt.scan_result == "fail"
+    assert _MVN_RULE in receipt.finding_summary
+    assert _CABAL_RULE not in receipt.finding_summary
+
+
+def test_mvn_deploy_file_is_the_same_class() -> None:
+    """``mvn deploy:deploy-file`` is the same Maven write class."""
+    body = "#!/bin/sh\nmvn deploy:deploy-file -Dfile=app.jar\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    assert any(
+        hit.rule_id == _MVN_RULE and hit.snippet == "mvn deploy" for hit in hits
+    )
+
+
+def test_cabal_list_and_mvn_package_stay_inventory(tmp_path: Path) -> None:
+    """Read-only cabal list and local mvn package stay inventory."""
+    root = _licensed_plugin(tmp_path, "#!/bin/sh\ncabal list\nmvn package\n")
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _hits(root, _CABAL_RULE) == []
+    assert _hits(root, _MVN_RULE) == []
+    assert receipt.scan_result == "pass"
+
+
+def test_hex_and_cabal_on_one_hook_are_distinct_findings(tmp_path: Path) -> None:
+    """One hook can fail closed on both hex publish and cabal upload."""
+    root = _licensed_plugin(
+        tmp_path,
+        "#!/bin/sh\nhex publish --yes\ncabal upload dist/app-1.0.0.tar.gz\n",
+    )
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _hits(root, _HEX_RULE)
+    assert _hits(root, _CABAL_RULE)
+    assert receipt.scan_result == "fail"
+    assert _MVN_RULE not in receipt.finding_summary
+
+
+def test_hex_publish_stays_the_hex_class() -> None:
+    """``hex publish`` remains the Hex.pm class, not Hackage."""
+    body = "#!/bin/sh\nhex publish --yes\n"
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    rule_ids = {hit.rule_id for hit in hits}
+    assert _HEX_RULE in rule_ids
+    assert _THIS_CLASS.isdisjoint(rule_ids)
+
+
+def test_comment_and_echo_cabal_mvn_are_not_this_class(tmp_path: Path) -> None:
+    """Unquoted comments and echo lookalikes are not executable publishes."""
+    root = _licensed_plugin(
+        tmp_path,
+        '#!/bin/sh\n# cabal upload\necho "mvn deploy -DskipTests"\n',
+    )
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _hits(root, _CABAL_RULE) == []
+    assert _hits(root, _MVN_RULE) == []
+    assert receipt.scan_result == "pass"
+
+
+def test_assignment_values_are_not_this_class() -> None:
+    """An unquoted assignment value cannot turn its following word into the CLI."""
+    bodies = (
+        "#!/bin/sh\nmessage=cabal upload dist/app-1.0.0.tar.gz\n",
+        "#!/bin/sh\ncommand=mvn deploy -DskipTests\n",
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert _THIS_CLASS.isdisjoint(hit.rule_id for hit in hits)
+
+
+def test_environment_assignment_before_real_command_still_fails() -> None:
+    """Environment assignments do not hide a later executable registry write."""
+    bodies = (
+        "#!/bin/sh\nCABAL_DIR=/tmp cabal upload dist/app-1.0.0.tar.gz\n",
+        "#!/bin/sh\nMAVEN_OPTS=-Xmx1g mvn deploy -DskipTests\n",
+    )
+    for body in bodies:
+        hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+        assert any(hit.rule_id in _THIS_CLASS for hit in hits)
+
+
+def test_readme_cabal_mvn_is_not_this_class(tmp_path: Path) -> None:
+    """README cabal/mvn wording is repository guidance, not a hook command."""
+    root = _licensed_plugin(tmp_path)
+    (root / "README.md").write_text(
+        "cabal upload dist/app-1.0.0.tar.gz\nmvn deploy -DskipTests\n",
+        encoding="utf-8",
+    )
+    receipt = build_claude_plugin_scan_receipt(root)
+    inventory = inventory_claude_plugin_capabilities(root)
+
+    assert _hits(root, _CABAL_RULE) == []
+    assert _hits(root, _MVN_RULE) == []
+    assert receipt.scan_result == "pass"
+    assert inventory["package_install"] is True
+
+
+def test_echo_then_real_cabal_upload_still_fails() -> None:
+    """``echo done && cabal upload`` still runs the registry write."""
+    hits = inspect_claude_plugin_file(
+        "session.sh",
+        "hooks/session.sh",
+        '#!/bin/sh\necho "done" && cabal upload dist/app-1.0.0.tar.gz\n',
+    )
+    assert any(
+        hit.rule_id == _CABAL_RULE and hit.snippet == "cabal upload" for hit in hits
+    )
+
+
+def test_snippets_are_command_labels_not_secrets(tmp_path: Path) -> None:
+    """Snippets name the CLI command and omit secrets and bidi."""
+    body = f"#!/bin/sh\ncabal upload --token {_SECRET}{_BIDI}\n"
+    root = _licensed_plugin(tmp_path, body)
+    hits = inspect_claude_plugin_file("session.sh", "hooks/session.sh", body)
+    cabal_hits = [hit for hit in hits if hit.rule_id == _CABAL_RULE]
+    payload = json.dumps(build_claude_plugin_scan_receipt(root).as_dict())
+
+    assert cabal_hits
+    for hit in cabal_hits:
+        assert hit.snippet == "cabal upload"
+        assert _SECRET not in hit.snippet
+        assert _BIDI not in hit.snippet
+        assert _SECRET not in hit.message
+    assert _SECRET not in payload
+    assert _BIDI not in payload
+
+
+def test_plugin_manifest_mvn_deploy_fails_admission(tmp_path: Path) -> None:
+    """A plugin.json command string that deploys to Maven is that class."""
+    root = _licensed_plugin(tmp_path)
+    manifest = json.loads(
+        (root / ".claude-plugin" / "plugin.json").read_text(encoding="utf-8")
+    )
+    manifest["hooks"] = {
+        "PreToolUse": [{"command": "hooks/session.sh"}],
+        "PostToolUse": [{"command": "mvn deploy -DskipTests"}],
+    }
+    _write_json(root / ".claude-plugin" / "plugin.json", manifest)
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _hits(root, _MVN_RULE)
+    assert receipt.scan_result == "fail"
+
+
+def test_manifest_prose_is_not_this_class(tmp_path: Path) -> None:
+    """Marketplace description prose about cabal upload is not a command."""
+    root = _licensed_plugin(tmp_path)
+    manifest = json.loads(
+        (root / ".claude-plugin" / "plugin.json").read_text(encoding="utf-8")
+    )
+    manifest["description"] = "Never runs cabal upload or mvn deploy."
+    _write_json(root / ".claude-plugin" / "plugin.json", manifest)
+    receipt = build_claude_plugin_scan_receipt(root)
+    assert _hits(root, _CABAL_RULE) == []
+    assert _hits(root, _MVN_RULE) == []
+    assert receipt.scan_result == "pass"