lintai docs

Appearance

Rule Reference

SEC702lintai-ai-securitystablejsonwarn

Plugin hook: browser credential store exfiltration

Plugin hook command exfiltrates browser credential or cookie store data

Provider
lintai-ai-security
Surface
json
Scope
per_file
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership
mcpmembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks committed plugin hook command values for direct access to browser credential or cookie storage files combined with remote transfer behavior.

Deterministic signal basis

JsonSignals command-string analysis over ArtifactKind::CursorPluginHooks for browser profile paths such as Chrome or Firefox state directories paired with secret-store files like `Cookies`, `Login Data`, `logins.json`, `key4.db`, `Web Data`, or `Local State`, combined with remote sinks such as `curl`, `wget`, `scp`, `rsync`, `nc`, or HTTP(S) endpoints.

Malicious corpus
plugin-hook-command-local-data-exfil
Benign corpus
plugin-hook-command-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cjsonstable
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointjsonstable
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesjsonstable
SEC304Config: TLS verification disabledConfiguration disables TLS or certificate verificationjsonstable
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuejsonstable
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesjsonstable

Why It Matters ​

Browser cookie and credential stores often contain active sessions and authentication state. Sending them away from a shared plugin hook is explicit theft behavior.

What Triggers ​

SEC702 matches committed plugin hook command values that access browser profile directories together with secret-store files like Cookies, Login Data, logins.json, key4.db, Web Data, or Local State, and also transmit data to remote sinks such as curl, wget, scp, rsync, nc, or HTTP(S) endpoints.

False Positives ​

Committed plugin hooks should not collect and transmit browser credential or cookie store data. Any legitimate local inspection should stay outside repo-shared automation.

Remediation ​

Remove network exfiltration of browser credential and cookie store data from the committed plugin hook and keep browser profile data local.