Run this plugin checklist before a Plugin4Shell-style swap runs code with your credentials

A pinned SHA can still point at the wrong code. Plugin4Shell is a zero-click remote-code-execution flaw in Claude Code, Codex, Copilot, and Gemini. The agent does not confirm that the working tree contains the commit it was told to pin.

The plugin supply chain is the risk, not just the plugin file. The checklist below is the minimum control set. Each item is a check you can run before a plugin runs. Use it for every new plugin and every plugin update before the agent runs the plugin.

SHA pinning stopped being a boundary

A pin tells the agent which commit to fetch. It does not prove the working tree holds that commit.

• Verify the resolved commit. Compare the working-tree commit hash to the pinned hash before execution, and fail on mismatch.
• Confirm patched agent versions. Check the installed agent version against the vendor's published fix before enabling the plugin.
• Audit the marketplace source. Confirm the plugin repository host, owner, and update path, and reject unreviewed third-party marketplaces.
• Disable auto-update. Turn off automatic plugin updates and require a named operator to approve each new version.
• Treat plugins as self-updating code. Confirm the stop control is independent of the plugin before the first run.

The checks close different paths: swap, unpatched agent, untrusted channel, silent drift, and blast radius. Run them in the same order every time. A failed check stops the deployment. A passing check only closes the known swap path.

The resolved commit is the real control

The check must happen after checkout, not before the agent starts. A mismatch is a stop condition. The agent must not execute plugin code until the check passes.

Record the expected hash, the resolved hash, and the time of the check. The record must be readable by an operator who did not install the plugin. If the record is missing, treat the plugin as unverified.

Run the check in the same environment where the agent executes the plugin. A hash verified on a build machine can be wrong on the runner. The working tree is the only thing that matters at execution time.

Host choice changes the attack surface. GitHub rejects branch names that look like 40-hex commit identifiers, while Bitbucket and self-hosted git servers allow them. The GitHub mitigation is not enough, because marketplaces can live on hosts such as Bitbucket. A stricter host does not make the whole supply chain safe. The marketplace can sit on a permissive host and still feed the agent.

Do not assume the marketplace URL is the repository URL. The marketplace can point to a different remote. The agent may fetch from the remote while the marketplace still displays the original pin. If the host allows commit-like branch names, require a host that blocks that pattern or add an explicit check that rejects it.

Patch status is not a single answer

After the June report, Anthropic released Claude Code 2.1.179 as a fix, and OpenAI released Codex 0.146.0 as a fix. Google told Air it would not patch Gemini CLI, deprecated the product, and directed users to Antigravity. Copilot is used by almost 90 percent of Fortune 500 companies, and no patch had shipped.

Version checks need automation. Track the agent version, the plugin version, and the update approval in the same record. A manual note is not enough. The fleet must know which agents are patched, which are unpatched, and which are deprecated. Deprecated products need a different answer. If a vendor will not patch a product, remove it from the plugin path or isolate it from production credentials. Large fleets make the unpatched case worse. A single unpatched agent can expose the whole fleet. Patch status belongs in the same dashboard that shows plugin versions, where an operator can see the gap before a plugin update.

The pipeline must reject swaps

A marketplace is a distribution channel, and the pin is only a suggestion if the channel can point the agent at a different repository. Marketplace roles matter. Check who can add a plugin, who can change its source, and who can approve a new version. If those roles are too broad, tighten them.

Auto-update removes the human decision point. A new version can arrive while the agent is idle and run before review. Frequent updates are a design problem. The operator must see the update request, review the change, and approve it with a named identity.

Scoped credentials limit the blast radius. Plugins must not hold standing secrets. A formatter does not need deployment tokens, and a read-only repository plugin does not need write access to production systems. The operator must be able to stop the agent and revoke the session credentials from the operator console.