Codex, Plugin
Example: Side Quest
Sample plugin that claims to add side quests to your docs, and hides a download.
Sample grade: F, Fail. Shape: Octagon.
On the real scale, F means: Fail. Do not install. That sentence describes the scale. It does not apply to a real package, because this page is example data.
Grades are a hygiene check, not a security guarantee. The date is part of the grade.
What was checked
These notes are written for the sample. They are not findings from a real review.
Permissions
Pass
The sample stays inside the access it describes.
Install and update
Fail
The sample install downloads and runs a binary the description does not mention.
Network
Concern
The sample download comes from a host the description skips.
Secrets
Pass
The sample does not read tokens, keys or environment variables.
Agent instructions
Pass
The sample instructions match the description and do not hide a step.
Obfuscation
Fail
The sample payload is encoded, so you cannot read what it will run.
Note
Example note. This fictional plugin fails. The sample install fetches a binary the description does not mention, and the payload is encoded. Do not install. This is not a report on a real package.
Date and source
Date checked: (sample date for the layout, not a real review).