Claude Code, Plugin
rashomon
Your coding agent's final diff does not tell the whole story.
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
install.sh, line 4
# curl -fsSL https://raw.githubusercontent.com/altrace-dev-role/rashomon/main/install.sh | sh - SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
internal/report/label_count_test.go, line 61
const smuggled = "/home/u/.ssh/id_rsa"
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
internal/launch/launch.go, line 91
cmd := exec.Command(path, argv[1:]...) //nolint:gosec // the command is the user's own argv
Install and update
Serious
install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.
INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER
README.md, line 38
curl -fsSL https://raw.githubusercontent.com/altrace-dev-role/rashomon/main/install.sh | sh
install.sh, line 4
# curl -fsSL https://raw.githubusercontent.com/altrace-dev-role/rashomon/main/install.sh | sh
internal/shape/hosts_test.go, line 40
{name: "piped", tool: "Bash", cmd: "curl -fsSL https://sh.rustup.rs|sh",
Network
Concern
can reach a host that is not written as a fixed address. can reach example.com. The description does not name that host. can reach pypi.org. The description does not name that host. can reach api.github.com. The description does not name that host. can reach registry.npmjs.org. The description does not name that host. can reach api.example.com. The description does not name that host. can reach files.pythonhosted.org. The description does not name that host. can reach x. The description does not
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST NETWORK_NAMED_HOST
install.sh, line 43
fetch() { curl -fsSL --proto '=https' --tlsv1.2 -o "$2" "$1"; }
install.sh, line 44
fetch_out() { curl -fsSL --proto '=https' --tlsv1.2 "$1"; }
install.sh, line 46
fetch() { wget -qO "$2" "$1"; }
Show more
install.sh, line 47
fetch_out() { wget -qO- "$1"; }
install.sh, line 49
die "needs curl or wget on PATH"
cmd/rashomon/main.go, line 1833
// reads only lowercase https_proxy, and curl is the first thing anyone tests
internal/launch/launch.go, line 42
// duplicate -- curl reads only lowercase https_proxy.
internal/launch/token_test.go, line 41
// TestEnv_CarriesTheTokenAsUserinfo, and both spellings, since curl reads only
internal/report/chains_test.go, line 299
// "a declared curl http://localhost:3000 reads not_observed_in_window on every
internal/shape/hosts_test.go, line 38
{name: "single quoted", tool: "Bash", cmd: `curl 'http://localhost:3000/health'`,
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
internal/report/label_count_test.go, line 61
const smuggled = "/home/u/.ssh/id_rsa"
internal/report/transcript.go, line 187
// covers, such as Read(./.env): Claude Code will not let the agent change what
internal/report/transcript_denial_test.go, line 233
"settings deny rule": "Permission to use Bash with command ls .env* has been denied.",
Show more
internal/report/transcript_denial_test.go, line 243
// Read(./.env). Refused by the same input check, before any hook, but in
internal/shape/hosts.go, line 368
// resolving would mean reading ~/.ssh/config, which is a file this package
internal/shape/hosts_test.go, line 235
{name: "ssh -i key", cmd: "ssh -i ~/.ssh/id_rsa [email protected]", wantSSH: []string{"h.example.com"}},
internal/shape/hosts_test.go, line 257
why: "recorded as named and never resolved: resolving would mean reading ~/.ssh/config"},
internal/shape/label.go, line 101
// (ssh-keygen(1): id_rsa, id_dsa, id_ecdsa, id_ed25519, and the _sk
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 4ab00fc01520. requests shell access. The manifest names this permission. install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach example.com. The description does not name that host. can reach pypi.org. The description does not name that host. can reach api.github.com. The description does not name that host. can reach registry.npmjs.org. The description does not name that host. can reach api.example.com. The description does not name that host. can reach files.pythonhos
Date and source
Date checked:
github.com
Commit graded: 4ab00fc015207b07d619b78db045443ce281ad2b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.