claude-plugin-converter

This module is a supply-chain amplifier: it generates an executable Hermes plugin package from untrusted on-disk inputs (plugin_dir and analysis.json). The fragment of generated hook code includes high-impact runtime sinks—subprocess execution with shell=True and outbound HTTP POST. If hook command strings and URLs are derived from untrusted metadata (as implied), a compromised source plugin/analysis can result in command execution and network exfiltration when the converted Hermes plugin is loaded. Confidence is reduced because the snippet appears partially garbled and the full implementations of convert_hooks/convert_commands are not included, preventing verification of allowlisting/sanitization or command/URL constraints.