makkov harness

Security index

Every third-party plugin here was read before you install it.

Each third-party piece was fetched without running, scanned, read by hand and pinned to the exact commit or version that passed. Here is every verdict, with what it runs, what it sends and what it needs from you.

Browse the index How a review works

Every verdict, and what it covers.

A verdict covers the version listed, on the date listed. Open a row for what it runs on its own, where it connects, what it needs and the exact commit that was read.

Transcribed from SECURITY.md and marketplace.json. Last review . A dash means the review notes say nothing about it.

How a review works.

The same steps for every piece: the first seven are the third-party-install-guard skill, the eighth is a weekly check on GitHub, and the ninth is a hook that makes Claude Code ask before anything installs. The scanner is a tripwire, not a verdict: reading the code by hand is what decides.

  1. Pin down exactly what it is

    The exact name, version and source address. “Latest” is resolved to a real version number, and the name is checked against look-alikes: swapped letters, a changed scope, an added -js.

  2. Check provenance and advisories

    Who publishes it and since when, whether the repository is alive, and the known vulnerabilities and malware advisories on OSV. An advisory with a MAL- id means red.

    • Published days ago
    • New single maintainer
    • Version with no tag behind it
    • Repository link missing or unrelated

  3. Fetch it without running it

    Into a fresh, empty folder. Repositories are cloned with git hooks, symlinks and submodules off; npm packages are downloaded as a file and unpacked, never installed; Python packages are never built.

    git -c core.hooksPath=/dev/null -c core.symlinks=false clone --depth 1 --no-recurse-submodules <url> <dir>

  4. Scan it, then run an antivirus pass

    A bundled scanner (Node, no dependencies, reads files only) looks for the patterns below, lists every file that runs on its own or configures an agent, and every binary that cannot be read as text. Then an antivirus pass: Windows Defender, or ClamAV where it is installed.

    High

    • Install-time scripts
    • Remote code (curl | sh, iex)
    • Hidden shell payloads
    • Eval of decoded data
    • Credential and wallet paths
    • Environment dumps
    • Exfiltration endpoints
    • Persistence
    • Destructive commands
    • Security-tool tampering
    • Prompt injection
    • Hidden Unicode

    Medium

    • Child processes
    • Network calls
    • Raw-IP addresses
    • Dynamic code
    • Obfuscation
    • Secret variables
    • Elevated privileges
    • Symlinks
    • Minified source
    • Git-only install scripts
    • Dependencies from outside the registry

    Low

    • Home-folder access
    • Commands added to PATH
    • Files too large to scan in full

  5. Read every file that runs on its own

    Always, even with zero findings: install scripts, hooks, plugin manifests, MCP tool handlers, and every SKILL.md, CLAUDE.md and AGENTS.md, looking for instructions aimed at the agent.

    • What runs at install and at first start?
    • What does it read: home folder, environment, credentials, other projects?
    • Where does it send data, and is that its stated job?
    • Does it download more code later?
    • Does the published package match its repository?

  6. Give a verdict

    Green

    A reputable source, no high findings, nothing on install that was not read. Installed at the reviewed version.

    Yellow

    Works, with a real risk: install scripts, broad access, a binary, a young project. The agent stops and asks you.

    Red

    Malware signs, credential access, exfiltration, hidden agent instructions, a look-alike name. Nothing is installed.

  7. Pin exactly what passed

    A companion's marketplace entry points at the exact commit that was read, and each cloud tool is installed at the exact version that was read. A newer version is not covered until it is reviewed again.

  8. Watch upstream every week

    Every Monday a GitHub Action reads each pinned upstream, read-only, and keeps one issue up to date: what moved, how many files changed, and how many of them are code or hooks. It never changes a pin.

    The workflowThe watch issue

  9. Ask before anything installs

    In Claude Code, a hook turns any command that installs or runs third-party code (npm install <package>, npx, pip install, curl … | sh) into a question to you, and reminds the agent to run this review first. It never blocks or runs anything, and installs from an existing lockfile pass. It raises the bar; it is not a sandbox.

    The hookWhat it is and is not

What the harness itself runs.

Our own code, held to the same rule: nothing runs that you cannot read. Each card links to its source.

    Review anything yourself.

    The guard ships with the harness. Once it is installed, it steps in before any install your agent does: packages, command-line tools, plugins, skills, MCP servers, extensions, scripts piped to a shell. You do not have to ask.

    Or ask for it by name

    Before installing anything from https://github.com/<owner>/<repo>, run third-party-install-guard and show me the verdict.

    What you get back

    • A one-line verdict: green, yellow or red.
    • Three to six points of evidence, with file and line for anything notable.
    • What happens next: green installs the reviewed version, yellow waits for you, red installs nothing.

    Want something added? Ask for a review.

    Open an idea with a link to its repository. It is reviewed the same way before it is added, and its verdict lands on this page. For anything sensitive, report it privately; please do not post working exploits in public issues.

    Request a review Report a problem privately