Node / ReticulumProjects / MeshChatX.git / files / docs / agents / skills / plugin-install-security / SKILL.md

Displaying Raw • View rendered • Download

Tc9d1d9# Skill: plugin-install-security

Install, sign, permission-grant, and sandbox plugins without bypassing RSG, integrity, or runtime guards.

Tc9d1d9## When to use

Tff7b72- Adding or changing plugin install / enable / invoke flows

Tff7b72- Declaring new hooks or manager capabilities

Tff7b72- Touching WASM, Python, or Sideband plugin runtimes

Tff7b72- Debugging "permission denied", signature failures, or silent disable after tamper

Tc9d1d9## Threat model (short)

Plugins are powerful. Treat install and enable as security-sensitive.

| Runtime | Risk | Notes |

| ------------------------- | ------ | ----------------------------------------- |

| Frontend Worker | Medium | Capability grants, isolated storage modes |

| Backend WASM | Medium | wasmtime fuel / capability gates |

| Backend Python / Sideband | High | Explicit danger / permission gating |

Tc9d1d9## Required flow

Tff7b721. Preview install (permissions, endpoints, signature status)

Tff7b722. User consent on declared permissions / network endpoints

Tff7b723. Enable only after grants are stored

Tff7b724. Runtime enforces declared + granted hooks / managers / storage / Ta5d6ff`network:fetch`

Tff7b725. Integrity hashing after install. Tampered trees disable, they do not silently run

Tc9d1d9## Hard rules

Tff7b72- Invalid RSG signatures **hard-block** install. Do not add bypass paths.

Tff7b72- ZIP extract must use zip-slip safe extraction. WASM must pass Ta5d6ff`validate_wasm_file`.

Tff7b72- New hooks go in Ta5d6ff`KNOWN_HOOKS`. New managers go in Ta5d6ff`KNOWN_MANAGERS` in Ta5d6ff`plugin_permissions.py`.

Tff7b72- Plugin i18n lives in the plugin bundle (Ta5d6ff`locales/{locale}.json`), not core Ta5d6ff`en.json`.

Tff7b72- Disable everything with Ta5d6ff`--disable-plugins` / Ta5d6ff`MESHCHAT_DISABLE_PLUGINS=true` when diagnosing.

Tc9d1d9## Key files

Tff7b72- Ta5d6ff`meshchatx/src/backend/plugin_manager.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/plugin_guard.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/plugin_permissions.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/plugin_signature.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/plugin_integrity.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/plugin_python_runtime.py`

Tff7b72- Ta5d6ff`meshchatx/src/frontend/js/plugins/pluginWorker.js`

Tff7b72- Ta5d6ff`meshchatx/src/backend/data/plugins/mcx-bugs/` (reference plugin)

Tc9d1d9## Verification

Ta5d6ff```Ta5d6ffbash

uv run pytest tests/backend/test_plugin_manager.py tests/backend/test_plugin_permissions.py tests/backend/test_plugin_signature.py tests/backend/test_plugin_integrity.py tests/backend/test_plugin_security.py -q --tbTff7b72=short

Ta5d6ff```

Add focused coverage when changing grant normalization, network endpoint scanning, or invoke paths.