Is a Claude Code mod safe? How to check an unsandboxed mod before installing it
A Claude Code mod is code that runs without a sandbox, with your permissions. It can read and write files, read environment variables (including API keys), launch programs and use the network. Before installing, list the
A Claude Code mod is code that runs without a sandbox, with your permissions. It can read and write files, read environment variables (including API keys), launch programs and use the network. Before installing, list the APIs the mod uses with claude plugin validate, check in the code why it uses $.http, $.env, $.process and $.fs, and install it pinned to the sha of the commit you read.
What a mod can reach
The "decide whether to trust a mod" section of the official overview lists what an installed mod can do:
| Capability | Details |
|---|---|
| Runs on your PC as you | Reads and writes files anywhere your user can, launches programs, uses the network |
| Reads secrets | Environment variables and settings files, including any API keys stored there |
| Sees the session | Every prompt you send and every tool call Claude makes |
| Changes the session | Rewrites prompts or tool calls, sends prompts as if typed by a person, messages other sessions |
| Acts without asking | Approves tool calls before you're asked |
| Uses your quota | Calls the model with your plan or API key |
And mods are not sandboxed. Even with Claude Code's sandbox turned on, only the Bash commands Claude runs are isolated; processes started by a mod run outside it.
One thing is protected: a mod can't redraw the permission prompt. It's built so a mod can't disguise what the confirmation screen shows. However, a mod can answer "allow" before the prompt is ever shown (the "acts without asking" row above).
Why reading the code is enough
For a mod's code to touch files, the network or processes, it must go through the $ API. Inside a hook there's no fetch, no process and no require (part 5). And at load time, Claude Code statically checks the source and only allows $ calls written out in full.
So if you search for $.http, $.process, $.fs and $.env, you'll find every place the mod touches the outside. The official docs also say this is why Claude Code can list "what it does" before installing a mod.
1. List it with claude plugin validate
Clone the mod's repo and run the check from a shell. It doesn't launch anything, so the mod's code doesn't run during validation.
git clone https://github.com/someone/some-mod
claude plugin validate .\some-mod
Look at these lines in the output:
| Line | What it tells you |
|---|---|
hooks: |
Which events it intercepts (tool.call, tool.check, prompt.submit and so on) |
calls: |
Which APIs it calls ($.http.fetch, $.process.run and so on) |
env reads:, env writes:
|
Which environment variables it reads or writes |
state reads:, state writes:
|
$.state values |
If something looks off, read that line in the code.
2. Check the reason for four APIs
Most mods are one or two files of a few hundred lines. Even if you can't read all of it, search for these four and confirm "why is this needed" for each, and you can spot almost anything dangerous.
| Search for | What to check |
|---|---|
$.http |
Is the destination host written in the code? What is being sent? |
$.env |
Which names does it read? Where does it pass the values? |
$.process |
Is the program name written in the code? Does it launch a shell (sh, bash, powershell.exe, cmd.exe) or curl? |
$.fs |
Where does it read and write? Does it read keys or config under your home folder? |
The ones to be most wary of are mods that both read ($.fs, $.env) and send ($.http), because that shape can ship what it read to the outside. That's fine if the reason is clear, but if a mod that only shows a clock in the band reads environment variables and talks to the network, don't install it.
Other things worth checking:
-
Does it intercept
tool.checkortool.calland return "allow"? That lets tools through without confirmation -
Where does it call
$.prompt.submitfrom? It can start turns without the person knowing (part 8) -
Does it call
$.model? That uses your quota -
Is there code you can't read? Minified one-liners,
eval,new Function, base64 blobs,import()with a computed path. If you can't read it, don't install it
3. Pin the version
What you read is the contents of one commit. A marketplace that points to the author's latest changes every time the author pushes. With auto-update on, code you haven't read comes in.
- Auto-update is off by default for marketplaces you added yourself. Keep it off for unfamiliar authors
- To pin to the commit you read, make your own marketplace and put that commit in the
sourcesha(part 9) - When updating, read the diff from the version you read last, then bump the
sha
4. Keep watching after install
If an installed mod worries you, disable it in the Installed tab of /plugin. To stop everything and see what happens, start with --safe-mode (part 1).
In an organization, admins can set policies such as "load only the organization's mods" (allowManagedModsOnly). You can also write a mod that refuses to load other mods (the plugin.register event). Details are on the official "Manage mods for your organization" page.
The 13 checks in the modscode review
The modscode review applies the checks above mechanically to 1,383 public mods. Of the 1,383 public mods on GitHub it read, 49 were written for the desktop app, work on Windows, and passed the review (as of 2026-10-06).
There are 13 checks, grouped into 4 by idea:
| Group | Checks | Related part |
|---|---|---|
| Usable on desktop | Written for the desktop app / installable from the desktop app (listed in marketplace.json) / works on Windows |
Parts 6, 7, 9 |
| Readable | Entry points read (every module named by hooks.json) / parseable / self-contained code (no external packages or require) / readable (no minified code, eval, or encoded blobs) |
End of step 2 above |
| Outside access is visible | Calls are visible (network and program launches written in place) / fixed destinations (the https host for fetch is in the code) / no shell | Table in step 2 above |
| Keeps secrets | Doesn't send what it reads (doesn't both read and send) / no keys (no API keys or private keys in the source) / open license | Step 2 above and the rules for copying code |
In numbers, 167 don't work on Windows and 269 can't be installed from marketplace.json. "Written for the desktop app" is especially strict; many mods written for the terminal drop out there.
However, as the modscode pages themselves say, this review does not guarantee that any mod is safe. It only checks whether the code is in a machine-readable shape and whether its outside access is visible. You still need to read before installing. Use the review as a pointer to where to start reading.
Summary
- Mods run without a sandbox, with your permissions
- Use
claude plugin validateto gethooks:,calls:andenv reads: - Search for
$.http,$.env,$.processand$.fsand confirm the reasons. Be especially careful with mods that both read and send - Pin to the
shaof the commit you read, keep auto-update off, and read the diff before bumping
If you need to explain what mods are to someone else, What are mods is a short summary.
This article was written with AI assistance (Claude) and checked against the official Claude Code docs; anything marked "not verified" could not be confirmed there.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.