Appearance
Why It Matters
SEC356 flags plugin agent markdown whose frontmatter sets permissionMode.
For shared plugin agents, this is a risky place to express permission policy:
- it mixes execution policy into agent content instead of keeping it in user or plugin configuration
- it makes agent review harder because content and permission posture are coupled
- it diverges from the plugin-agent layout guidance documented for Claude plugin agents
What Triggers
This rule applies only to plugin agent markdown surfaces and triggers on parsed frontmatter that contains the exact key:
permissionMode
Example that triggers:
yaml
---
name: review
permissionMode: acceptEdits
---Examples that stay clean:
yaml
---
name: review
allowed-tools: Read, Write
---- fixture-like paths under
tests/,fixtures/,examples/, orsamples/ - non-plugin markdown like ordinary
SKILL.md
False Positives
This rule now lives in the explicit guidance lane because some repos may still experiment with unsupported or transitional plugin metadata. The signal is intended as structural policy guidance, not as proof of exploitation.
Remediation
Remove permissionMode from plugin agent frontmatter and manage permission policy in plugin-level or user-level configuration instead.
Good pattern:
yaml
---
name: review
allowed-tools: Read, Write
---