Answers · agent safety

How do I tell if a Claude Code or Cursor plugin is safe to install?

Short answer: Treat a coding-agent plugin as software you are running, not as a settings file. Anthropic's own documentation says a Claude Code plugin can execute arbitrary code on your machine with your user privileges: its hooks and monitors are shell commands, its MCP and LSP servers are processes Claude Code starts, its bin/ folder lands on the Bash tool's PATH, and its skills, commands and agents go into Claude's context as instructions. Permission rules and the sandbox cover Claude's tool calls, not the hooks, monitors and servers a plugin runs on its own. So before installing: check which marketplace it comes from, read the Will install list in /plugin, read the files that actually run (hooks/hooks.json, .mcp.json, bin/), try it at local scope first, and decide whether you want it to auto-update. Cursor Marketplace plugins are manually reviewed and must be open source, but Cursor still calls installation the user's own risk and recommends reading the source.

Checklist

1. Check the marketplace: claude plugin marketplace list prints where each marketplace came from. Official and community names (such as claude-plugins-official and claude-community) are only accepted from github.com/anthropics repositories; every other marketplace is third-party, including one a coworker or your company runs. A marketplace's name tells you who runs the catalog, not what each plugin in it does.
2. Read the Will install section: run /plugin, open the plugin, and look at the commands, agents, skills, hooks, and MCP and LSP servers it adds. A plugin that only adds skills is a different risk from one that adds hooks and a stdio MCP server.
3. Read what runs, not just what's listed: the details pane shows that a hook exists but not its command. Open the plugin's source and read hooks/hooks.json (the command each hook runs), .mcp.json (each server's command or URL), every file in bin/, and any monitors.
4. Inspect before installing: clone the plugin's repository and run claude --plugin-dir <dir> plugin details <name> to print its component inventory without starting a session.
5. Read the skills, commands and agents as instructions: look for text that tells Claude to fetch URLs, read credentials or files outside the project, send data elsewhere, or skip confirmations. Hidden or zero-width text in them is a red flag.
6. Start narrow: choose Install for you, in this repo only (local scope) to try it, not project scope, which turns it on for everyone who works in the repository once they install it.
7. Decide on updates: auto-update is on by default for Anthropic's official marketplaces and off for community and third-party ones. Auto-update means the files you reviewed can change on disk; to pin, add a marketplace at a tag (owner/repo#v1.2.0) and keep auto-update off for marketplaces you don't control.
8. Cursor: plugins from the Cursor Marketplace are manually reviewed before listing and on every update, and must be open source; community plugins on cursor.directory are not that marketplace. Plugins respect your MCP allowlist and blocklist, so a blocked server inside a plugin can't make calls.
9. Remove cleanly if you change your mind: claude plugin uninstall <plugin> --scope <scope>. Cached files stay under ~/.claude/plugins/cache/ for 14 days unless you delete them, and removing a marketplace uninstalls every plugin you installed from it.

Why a plugin is riskier than a single MCP server

• An MCP server only acts when the model calls one of its tools, and your permission rules apply to those calls. A plugin's hooks fire on lifecycle events such as before or after a tool call, and its monitors run as background shell commands that Claude Code starts on its own (at session start, on plugin reload, or when a named skill first runs), without Claude deciding to call anything.
• Claude Code runs hooks, monitors, MCP servers and LSP servers outside the sandbox, with your full user permissions. That is where a malicious or careless plugin does its damage: reading ~/.ssh, .env files or tokens, or sending them over the network.
• Skills and agent definitions can't run code by themselves, but they steer what Claude does with the tools it already has, so they are a prompt-injection surface like any tool description.

Controls for teams

• In Claude Code managed settings, strictKnownMarketplaces allowlists marketplace sources (an empty list blocks every source, including the official one), blockedMarketplaces blocklists them and is checked first, allowManagedHooksOnly limits which hooks run, and disableSideloadFlags rejects --plugin-dir and similar flags.
• pluginTrustMessage appends your own text to the trust warning Claude Code shows before an install, for example a link to your internal review process.
• In Cursor, Teams and Enterprise plans can run team marketplaces so members install from a reviewed internal catalog.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before I enable this plugin, check the MCP server it bundles: is it listed, what tools does it expose, and have its tool definitions changed since they were recorded?”

One-click setup

{
  "tool": "precall_check",
  "arguments": {
    "url": "<the https URL of the plugin's MCP server>"
  }
}

• scan_text checks a skill, command or agent file for content a reader cannot see (zero-width characters, bidirectional controls, Unicode tag characters, hidden markup, base64 blobs) before you let it into Claude's context.
• check_license with the plugin's GitHub URL as source_url tells you what license its code is under.
• check_listing tells you whether a server is a vetted listing in the Rightshold Store. An unlisted server is unvetted, which is not the same as unsafe.

Rightshold does not review or certify Claude Code or Cursor plugins. It checks remote MCP servers' listings and tool definitions and scans text you give it; hooks, monitors and bin/ files run locally and need your own review.

Sources

• Claude Code docs: Plugin security and trust
• Claude Code docs: Install and manage plugins
• Claude Code docs: Manage plugins for your organization
• Claude Code docs: Plugin manifest reference
• Cursor docs: Plugins
• Cursor: Marketplace security

Related

• How to vet an MCP server before installing it
• How to keep .env secrets and API keys away from AI coding agents
• How to detect MCP tool description changes (rug pulls)
• How to pin MCP server versions and review changes before upgrading

Not legal advice. Updated 2026-10-29. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'