lintai docs

Appearance

Rule Reference

SEC343lintai-ai-securitystablejsonwarn

Plugin hook: mutable package launcher

Plugin hook command uses a mutable package launcher

Provider
lintai-ai-security
Surface
json
Scope
per_file
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership
mcpmembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks committed plugin hook command values for mutable package launchers such as npx, uvx, pnpm dlx, yarn dlx, and pipx run.

Deterministic signal basis

JsonSignals command-string analysis over ArtifactKind::CursorPluginHooks objects limited to actual hook command values.

Malicious corpus
plugin-hook-command-mutable-launcher
Benign corpus
plugin-hook-command-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cjsonstable
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointjsonstable
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesjsonstable
SEC304Config: TLS verification disabledConfiguration disables TLS or certificate verificationjsonstable
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuejsonstable
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesjsonstable

Why It Matters ​

Committed plugin hook commands should be reproducible and reviewable. Launching them through mutable package runners such as npx or uvx makes the hook depend on whatever the registry serves at execution time.

What Triggers ​

SEC343 applies to committed plugin hook command values and triggers on mutable package launchers such as npx, uvx, pnpm dlx, yarn dlx, or pipx run.

Example that triggers:

json
{"hooks":{"stop":[{"command":"npx @acme/plugin-hook"}]}}

Example that stays clean:

json
{"hooks":{"stop":[{"command":"node ./hooks/cleanup.js --mode safe"}]}}

False Positives ​

This is a structural command-string rule over actual plugin hook command values. It does not fire on prose examples or on ordinary local script execution.

Remediation ​

Replace the mutable launcher with a vendored, pinned, or otherwise reproducible execution path.