Agent plugin integrity

Definition & limits

Agent plugin integrity has at least two independent surfaces. Acquisition integrity requires verifying the resolved artifact, package hash, source and publisher against the reviewed pin; an apparent pin or signed repository reference is insufficient if clients execute a different checkout. Runtime configuration integrity requires reviewing the effects of lifecycle scripts on durable user agent settings, MCP registration, telemetry and enabled tools. These writes may outlive the installation operation and broaden future authority even when package files themselves remain intact. The toga-ai and common-context-mcp findings are currently source-linked scanner reports of persistent changes, not independently confirmed data theft. A tool listing guard also needs execution-time enforcement rather than assuming that an excluded tool is unreachable. Telemetry modification, MCP memory registration, tool execution mismatch.

The protected artifact is not just the installed code bundle. Install scripts can change a client's global plugin registry, tool list, telemetry policy and reusable memory files outside the package path. The dependency manager can correctly verify a package tarball while a locally authorized lifecycle script rewrites those other durable inputs. Guardrails therefore need distinct evidence for package provenance, installation effects, later tool invocation and rollback. The three scoped package analyses illustrate different stages: immediate postinstall settings, future MCP activation, and setup-time credential collection.

Cursor’s October 2026 malicious Claude Code VSIX incident adds a distribution case: a trusted-looking extension name and version were not sufficient to establish that the installed artifact matched the intended publisher. The distinction is not limited to source review. A complete check verifies the extension package hash, the marketplace distribution path, each installed platform variant, and executable persistence behavior after installation. Reported download reach cannot be equated with successful SSH persistence. Versioned malicious extension.

Integrity must also be evaluated across both time and skill composition. SkillLifeBench demonstrates a temporal failure: an agent selects a patched skill version yet invokes a still-loaded older handle, so its actual filesystem authority has not changed. This is not another malicious publication event; it is a mismatch between declared update state and the executable artifact that still exists in memory. Scan Before You Install illustrates the other axis: separately legitimate skills can be composed so a history-reading or watcher capability sends sensitive material through a Slack or OAuth-capable neighbor. One package hash cannot establish the safety of the resulting multi-tool workflow. The relevant invariants are executable handle identity at call time, revoked access after updates, and explicit permission for cross-skill data transfer. Skill lifecycle and composition tests.

A third boundary is runtime hook privilege, separate from acquiring the approved package and from what tools the model is allowed to call. CERT-EU altered local copies of Pi and Claude Code extensions and placed a credential-collection routine in event handlers that ran before or beside model tool execution. Trigger text activated the collection without a visible malicious tool call, even while the ordinary agent features kept working. This was an isolated laboratory exercise, not proof of a compromised public release. Inspection must therefore cover active extension code, its process permissions, inherited credentials and outbound requests, instead of relying solely on model-facing tool approval or an unchanged tool catalog. CERT-EU experiment.

The October 29 Cursor Marketplace incident is now independently scoped by Cursor and Microsoft. Cursor says malicious Windows and macOS builds of Anthropic.claude-code were supplied from its marketplace as versions 2.1.312 and 2.1.313, not only 2.1.313. A JavaScript loader ran before the legitimate extension and attempted to add a svc-telemetry authorized SSH key, create persistent launch scripts, report host details and open a reverse SSH tunnel to 134.209.82.225. Microsoft identifies the collected sensitive environment information as variable names, not proven values. Cursor says enabling a local SSH server generally failed without administrator permissions and the remote server was taken offline. Thus distribution of a tainted artifact was real, while successful remote workstation takeover on every installation is not established. Microsoft confirmed the npm package and Microsoft Visual Studio Marketplace were not affected; the OpenSourceMalware artifact review identifies Open VSX as outside the compromised channel. The evidence does not establish that an Anthropic employee account was compromised. A response still needs affected artifact hashes, local persistence and network telemetry checks, and credential rotation where exposure is identified. Existing Case, Cursor statement.

A November procedural-poisoning study adds a different plugin integrity failure from malicious installer code. StealthyPoison manipulated decision-critical rules in retrieved third-party skills while leaving their advertised task and prose plausible. A repository or registry could return an authentic-looking version of a skill that is still semantically wrong. Provenance checks and scanner patterns address only part of this risk: a valid package signature does not prove a procedure continues to reflect an independently approved user objective. The controlled outcomes are not evidence that the same payload is deployed in an enterprise registry. Miasma's agent startup hooks demonstrate the separate case where the imported component may execute code before the model reasons about it.

Procedural authorization is another artifact boundary. The StealthyPoison evaluation shows how a skill may be selected for a legitimate task yet contain decision-critical steps that move the agent toward an attacker objective without an obvious jailbreak phrase. A separate Miasma repository case shows two possible execution routes: model obedience to forged instructions and automatic session-start hooks. The latter can run before any explicit model tool choice. Integrity checks must therefore retain the reviewed artifact hash, runtime handle identity, startup-hook list and the actual process effects, rather than assume that a clean conversation proves a clean execution.

Examples

• Plugin4Shell bypassed SHA-pinned plugin identity because clients did not verify the resolved checkout.
• ClawHavoc shows why agent extension ecosystems also need publisher, permission and runtime controls even when no pinning bypass is involved.
• Install-time rewriting of global agent telemetry in toga-ai demonstrates authority beyond the package directory.
• The common-context-mcp installer registers persistent MCP memory in multiple agent configurations without independently proving exfiltration.
• A patched skill package is selected in the interface but a still-loaded prior-version handle retains the old filesystem authority.
• Two individually reviewed skills produce an unauthorized read-to-send chain when an agent composes their permissions.
• Cursor Marketplace delivered tampered Anthropic.claude-code versions 2.1.312 and 2.1.313, while Microsoft and Anthropic did not report a compromise of official npm or Visual Studio Marketplace distributions.

Explicit mappings

Research using this topic (53)