{"slug":"security-watchdog","title":"security-watchdog","description":"> Automatic security scanner for Claude Code plugins — detects new or updated extensions at session start and scans them for prompt injection, malicious hook scripts, and data exfiltration.\n\n## The Problem\n\nLLM extension ecosystems are a novel attack surface. Traditional security tooling does not cover two threats unique to AI extensions:\n\n- **Host attacks** — hook scripts run shell commands automatically on session start, with full user privileges\n- **Mind attacks** — skill and command files are injected directly into the model's reasoning context, enabling prompt injection\n\nNo existing security scanner understands these threat classes. Security Watchdog is purpose-built for them.\n\n## How It Works\n\n```\nYou run: /plugin install someone/new-plugin\n↓\nNext session starts (SessionStart hook fires)\n↓\ncheck-new-plugins.sh diffs installed_plugins.json\nagainst a snapshot from the previous session\n↓\nNew/updated plugin detected\n↓\nInjects into session context:\n\"SECURITY WATCHDOG ALERT: forge@forge was installed.\nRun /scan-plugin forge@forge before proceeding.\"\n↓\nClaude runs /scan-plugin, reads all plugin files,\napplies security checks, and reports findings\n```\n\nThe snapshot is updated on detection — each change event fires the alert exactly once.","developer":null,"category":null,"reported_installs":null,"active":true,"first_seen_at":"2026-10-03T22:13:33.942Z","last_seen_at":"2026-11-07T00:08:29.147Z","last_changed_at":"2026-10-03T22:13:33.942Z","platform":"claude","sources":["Community"],"works_with":["Claude Code"],"marketplace_url":null,"repository_url":"Entelligentsia/skillforge","web_data":{},"github_data":{},"catalog_sources":{"community":[{"name":"security-watchdog","source":{"ref":"main","sha":"1abfa8b6f22d3116b6ccd0147fbeb217b06f7e38","url":"Entelligentsia/skillforge","path":"security-watchdog","source":"git-subdir"},"homepage":"https://entelligentsia.in/open-source/skillforge","description":"> Automatic security scanner for Claude Code plugins — detects new or updated extensions at session start and scans them for prompt injection, malicious hook scripts, and data exfiltration.\n\n## The Problem\n\nLLM extension ecosystems are a novel attack surface. Traditional security tooling does not cover two threats unique to AI extensions:\n\n- **Host attacks** — hook scripts run shell commands automatically on session start, with full user privileges\n- **Mind attacks** — skill and command files are injected directly into the model's reasoning context, enabling prompt injection\n\nNo existing security scanner understands these threat classes. Security Watchdog is purpose-built for them.\n\n## How It Works\n\n```\nYou run: /plugin install someone/new-plugin\n↓\nNext session starts (SessionStart hook fires)\n↓\ncheck-new-plugins.sh diffs installed_plugins.json\nagainst a snapshot from the previous session\n↓\nNew/updated plugin detected\n↓\nInjects into session context:\n\"SECURITY WATCHDOG ALERT: forge@forge was installed.\nRun /scan-plugin forge@forge before proceeding.\"\n↓\nClaude runs /scan-plugin, reads all plugin files,\napplies security checks, and reports findings\n```\n\nThe snapshot is updated on detection — each change event fires the alert exactly once."}]},"manifest":{}}