--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Node / ReticulumProjects / MeshChatX.git / files / docs / agents / skills / plugin-install-security / SKILL.md
docs/agents/skills/plugin-install-security/SKILL.md HEAD (b89dc9e6) Text, 2.49 KB
Skill: plugin-install-security
Install, sign, permission-grant, and sandbox plugins without bypassing RSG, integrity, or runtime guards.
When to use
• Adding or changing plugin install / enable / invoke flows
• Declaring new hooks or manager capabilities
• Touching WASM, Python, or Sideband plugin runtimes
• Debugging "permission denied", signature failures, or silent disable after tamper
Threat model (short)
Plugins are powerful. Treat install and enable as security-sensitive.
┌───────────────────────────┬────────┬───────────────────────────────────────────┐
│ Runtime │ Risk │ Notes │
├───────────────────────────┼────────┼───────────────────────────────────────────┤
│ Frontend Worker │ Medium │ Capability grants, isolated storage modes │
│ Backend WASM │ Medium │ wasmtime fuel / capability gates │
│ Backend Python / Sideband │ High │ Explicit danger / permission gating │
└───────────────────────────┴────────┴───────────────────────────────────────────┘
Required flow
1. Preview install (permissions, endpoints, signature status)
2. User consent on declared permissions / network endpoints
3. Enable only after grants are stored
4. Runtime enforces declared + granted hooks / managers / storage / T383838network:fetch
5. Integrity hashing after install. Tampered trees disable, they do not silently run
Hard rules
• Invalid RSG signatures hard-block install. Do not add bypass paths.
• ZIP extract must use zip-slip safe extraction. WASM must pass T383838validate_wasm_file.
• New hooks go in T383838KNOWN_HOOKS. New managers go in T383838KNOWN_MANAGERS in T383838plugin_permissions.py.
• Plugin i18n lives in the plugin bundle (T383838locales/{locale}.json), not core T383838en.json.
• Disable everything with T383838--disable-plugins / T383838MESHCHAT_DISABLE_PLUGINS=true when diagnosing.
Key files
• T383838meshchatx/src/backend/plugin_manager.py
• T383838meshchatx/src/backend/plugin_guard.py
• T383838meshchatx/src/backend/plugin_permissions.py
• T383838meshchatx/src/backend/plugin_signature.py
• T383838meshchatx/src/backend/plugin_integrity.py
• T383838meshchatx/src/backend/plugin_python_runtime.py
• T383838meshchatx/src/frontend/js/plugins/pluginWorker.js
• T383838meshchatx/src/backend/data/plugins/mcx-bugs/ (reference plugin)
Verification
T282828
uv run pytest tests/backend/test_plugin_manager.py tests/backend/test_plugin_permissions.py tests/backend/test_plugin_signature.py tests/backend/test_plugin_integrity.py tests/backend/test_plugin_security.py -q --tbTff7b72=short
Add focused coverage when changing grant normalization, network endpoint scanning, or invoke paths.
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────