claude-plugin-converter

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The converter explicitly reads and reproduces shell commands and MCP config / env var snippets (embedding them into generated Python files using repr()), so any secrets present in the source plugin would be copied verbatim into the LLM's output — enabling secret exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The converter intentionally preserves and embeds arbitrary hook behavior from source plugins — including executing shell commands (subprocess.run(..., shell=True)) and POSTing event data to arbitrary URLs — which enables remote code execution and data exfiltration if used on untrusted plugins.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Phase 1 discovery and Phase 2 conversion both ingest outsider-authored plugin text from a user-supplied Claude Code plugin directory path, reading files like .claude-plugin/plugin.json, skills/*/SKILL.md, hooks/hooks.json, and .mcp.json via analyze_plugin()/analyze_*() before generating hooks.py and __init__.py.