security-watchdog или the-safety-net

> Automatic security scanner for Claude Code plugins — detects new or updated extensions at session start and scans them for prompt injection, malicious hook scripts, and data exfiltration. ## The Problem LLM extension ecosystems are a novel attack surface. Traditional security tooling does not cover two threats unique to AI extensions: - **Host attacks** — hook scripts run shell commands automatically on session start, with full user privileges - **Mind attacks** — skill and command files are injected directly into the model's reasoning context, enabling prompt injection No existing security scanner understands these threat classes. Security Watchdog is purpose-built for them. ## How It Works ``` You run: /plugin install someone/new-plugin ↓ Next session starts (SessionStart hook fires) ↓ check-new-plugins.sh diffs installed_plugins.json against a snapshot from the previous session ↓ New/updated plugin detected ↓ Injects into session context: "SECURITY WATCHDOG ALERT: forge@forge was installed. Run /scan-plu

7 hooks for Claude Code covering safety, context injection, auto-formatting, model routing, and session lifecycle -- built from 6 months of daily use.