Fix repository config adds a third-party plugin or skill source in Claude Code

Repository-local configuration registers an extra plugin marketplace, skill directory, or extension source, or installs from one automatically. A marketplace reference is a delegation of trust the repository is making on the developer's behalf.

medium likely Claude Code CWE-1357 / ASI ASI04

The vulnerable pattern in Claude Code

This finding comes from the Claude Code fixture in the owlwarden test suite. This repository registers `github` as a source of plugins or skills. Anything that source serves runs with the same access as the agent, and the decision to trust it was made by whoever opened the pull request.

The corrected configuration

Remove `extraKnownMarketplaces` from `.claude/settings.json`. Ask developers to run `/plugin marketplace add` themselves, so the trust decision is theirs and is visible when they make it.

// .claude/settings.json - no marketplace entries
{ "permissions": { "allow": [] } }

If you are not using Claude Code

Take the source out of the repository. If the team wants it, each developer adds it once, deliberately, at user level - the difference being that they chose to.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-marketplace-untrusted

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Claude Code checks

Rules with a tested Claude Code example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-instructions-hidden-text high Instruction file contains text a human reader cannot see
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-marketplace-untrusted for every agent host / All rules / owlwarden