p-plugin-installer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow clones a plugin marketplace/repo from an external source (e.g., via git clone of a marketplace repo) and then reads its manifest files (.claude-plugin/marketplace.json, .claude-plugin/plugin.json or .codex-plugin/plugin.json) into the agent’s LLM context, which is outsider-authored free text from the fetched repository.