Repository navigation
Install-time scanning for MCP servers, skills, and agent-added dependencies #305
Description
Inspired by Socket Firewall (intercept at the package manager, block before install; Replit ships it to block 8,000+ malicious packages daily) and Snyk's ToxicSkills audit (36% of public agent skills contain prompt-injection payloads).
Solenta users will paste skills and MCP configs from the internet, and agents will npm-install whatever they like. Add an install-time gate: scan MCP server configs and skills before enabling them, and optionally intercept package installs in agent shells against a malware feed. Report trust levels up front, like Kimi's plugin marketplace does.
Activity
currentbits commentedon Aug 18, 2026
From the CLI doc-mines: (1) Codex hook trust-by-hash — hooks are trusted by content hash with a /hooks review UI; a changed hook definition forces re-review, and allow_managed_hooks_only is the admin lockdown. Adopt for Solenta's hook/skill installs. (2) Kimi's workspace trust gate — binaries (fd, stty) are resolved to ABSOLUTE PATHS to defeat binary-planting in untrusted repos, and repo-shipped prompt files are treated as code. Apply to anything Solenta executes from a worktree.
currentbits commentedon Aug 18, 2026
Round 20 intel: Codex CLI 0.147.0 plugin hardening adds two fail-closed rules worth adopting verbatim: (1) deny network access when a policy update fails to apply (#36037, #36967): if the sandbox cannot confirm its current rules, the answer is no network, not best-effort; (2) plugin isolation hardened so a malicious plugin cannot reach beyond its grant (#37027). Same fail-closed family as the Cursor canonicalization CVEs noted on #262: every policy-enforcement error path must resolve to deny. Also relevant: Copilot CLI now enforces an enterprise sandbox floor where
--no-sandboxis ignored with an explanation rather than silently having no effect: overrides must be loud.currentbits commentedon Aug 18, 2026
Round 22 intel: Claude Code marketplaces can now distribute a plugin as a zip archive over HTTPS with an optional SHA-256 pin (the
archivesource), so installs work without git or npm. For the install-time scanner this adds a format to handle: archive-source plugins bypass git metadata entirely, so the only integrity anchor is the pin. Rule: no SHA-256 pin, no install (or at minimum a loud unverified-install warning), and the scanner should diff archive contents against the declared manifest before enabling.currentbits commentedon Aug 18, 2026
Round 24 intel: the skill supply-chain problem now has a measurement backbone. The GitSkills dataset (arXiv, 2026-08-11) harvested 3.8 million SKILL.md files from public GitHub repos, giving a reproducible snapshot of how skills are written, reused, and distributed. Follow-on audits plus Snyk's earlier ToxicSkills analysis keep finding high rates of prompt-injection payloads, secret exfiltration, and supply-chain abuse in public skill registries (summary: aiagentstore weekly, Aug 10-18). Two implications for this issue: (1) the scanner should treat SKILL.md like code: lint, static patterns, and an LLM triage pass, with install blocked until pass + approver sign-off, exactly the CI-gating flow enterprises are now adopting; (2) popularity-weighted review is now possible: for any skill Solenta installs, its content can be compared against near-duplicates in the wild (most skills are copies of copies), so a skill whose content diverges from the common lineage is a red flag worth surfacing.
currentbits commentedon Aug 18, 2026
Round 28 micro-intel: skillfold declares skills in YAML and pins exact revisions in a lockfile so installs are reproducible across Claude Code and Codex. If Solenta's skill inventory (#343 lineage) grows provenance, the lockfile is the right primitive: skill name + source + content hash, checked into the repo, so "which exact skill version produced this thread" is answerable and installs are auditable and diffable in PR review.
currentbits commentedon Aug 22, 2026
Shipped in this worktree (install-time gate, local, no network):
Skills.
listSkillsattaches a trust report (trusted / caution / blocked) from SKILL.md.addSkillrefuses blocked payloads (prompt injection, curl|sh, guardrail bypass, known-maliciousnpm install) unlessforce: true. The Skills tab shows the badge up front and asks before adding.MCP. Remote https is Caution (the server sees agent context). Remote http, credentials-in-URL, and secret-shaped query strings are Blocked and cannot be newly enabled. Already-enabled blocked servers are grandfathered. Loopback is Trusted.
Package installs.
classifyCommanddenies known-malicious names against a bundled typosquat seed (electron/malware-packages.json) plus optionaluserData/malware-packages.json. Settings → General: Block known-malicious (default) / Ask on every package install / Allow all. Kill switch is stillCODER_GUARDRAILS=off.Honest limitation: the shell intercept rides Claude's
can_use_toolseam (the only placeclassifyToolruns today). Grok/Codex/Kimi shells are not gated yet.currentbits commentedon Sep 8, 2026
Shipped in PR #661 (install-time trust gate for skills, MCP servers, and package installs). Closing the leftover plan:doing.