Plugin Security

REFERENCE MODE: This skill provides reference material for reviewing and hardening the security of marketplace meta-project components. Load a specific standard on-demand based on the surface being reviewed. Do not load both standards at once.

This skill is the plan-marshall-plugin-dev domain's security surface. Unlike the per-language security skills (pm-dev-python:python-security, pm-dev-java:java-security), which are thin pointers over a single stdlib, this skill is a deep, meta-project-focused security home: the marketplace's own attack surface is not "a Python app" or "a Java app" but a two-headed substrate — the Python script surface that every manage-* / build / extension script presents, and the markdown trust surface that every skill, command, and ingestion doc presents to the model that loads it. Both are owned here. The cross-cutting why (OWASP categories, STRIDE, trust-boundary architecture, secrets, secure logging, secure-design principles) is NOT restated here — it is delegated upward to plan-marshall:persona-security-expert, the single authoritative home.

Enforcement

Execution mode: Reference library; load a standard on-demand for the marketplace surface under review. No execution logic in this SKILL.md.

Prohibited actions:

• Never read an environment variable (os.environ.get(...)) and construct a filesystem Path, a subprocess argv element, or a network target from it without validating it against a safe base or allow-list first. Environment is an untrusted boundary in a tool a consumer project drives.
• Never pass a value sourced from an extension's get_skill_domains() (a domain key, a profile name, a skill notation) into a downstream filesystem, subprocess, or import call without confirming it against the declared allow-list of known domains/profiles. Extension data is bundle-author-controlled, not core-controlled.
• Never add a new external-content ingestion surface (web page, GitHub issue/PR/comment body, Sonar message, or any other attacker-influenceable text) that consumes raw bytes in a write-capable or skill-loading context without routing the candidate struct through the deterministic plan-marshall:untrusted-ingestion:validate_struct gate.
• Never author skill/command/agent prose that interpolates untrusted external text into instructions the model will execute, nor that can be read as an instruction-injection vector.