Plugin Supply-Chain Intake Standard
Third-party plugins, extensions, and AI skills represent execution vectors requiring strict intake validation.
Intake Controls
- Source & Manifest Audits: Code reviews and permission requirement audits prior to intake.
- Runtime Sandboxing: Capabilities restricted across filesystem, network, and environment variables.
- Pinned Checksums: Plugin versions pinned to immutable hashes with automated update workflows.