chore: import upstream snapshot with attribution

2026-07-13 12:20:06 +08:00
commit f4548892ad
1138 changed files with 185224 additions and 0 deletions
@@ -0,0 +1,52 @@
+{
+  "type": "object",
+  "required": [
+    "passes",
+    "summary",
+    "violations",
+    "may_make_external_network_calls",
+    "may_download_additional_software",
+    "hooks",
+    "has_broad_scope_hooks",
+    "has_undisclosed_telemetry",
+    "description_matches_behavior"
+  ],
+  "additionalProperties": true,
+  "properties": {
+    "passes": {
+      "type": "boolean",
+      "description": "true only if the plugin is safe AND has no broad-scope hooks AND has no undisclosed telemetry AND its description matches its behavior."
+    },
+    "summary": {
+      "type": "string",
+      "description": "Brief description of what the plugin does."
+    },
+    "violations": {
+      "type": "string",
+      "description": "Specific files/hooks and issues, or empty string if none. When passes=false this MUST cite the file/hook and state what the user was not told."
+    },
+    "may_make_external_network_calls": {
+      "type": "boolean"
+    },
+    "may_download_additional_software": {
+      "type": "boolean"
+    },
+    "hooks": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "One string per registered hook: 'EVENT:path — gated|ungated — network:yes(host)|no'. Empty array if the plugin registers no hooks."
+    },
+    "has_broad_scope_hooks": {
+      "type": "boolean",
+      "description": "true if any UserPromptSubmit/PreToolUse/PostToolUse hook runs without a project-relevance gate, or any hook reads user data beyond the plugin's stated scope."
+    },
+    "has_undisclosed_telemetry": {
+      "type": "boolean",
+      "description": "true if any hook or shipped code makes an outbound network call to a non-MCP host without explicit disclosure + opt-out in the description/README."
+    },
+    "description_matches_behavior": {
+      "type": "boolean",
+      "description": "false if a user reading only the plugin.json description would be surprised by the hooks/telemetry/data-access the plugin actually performs."
+    }
+  }
+}