Skip to content

chore(scan): answer the hol plugin scanner findings #649

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
using-system merged 1 commit into from
Sep 23, 2026
+18 −4
Merged

chore(scan): answer the hol plugin scanner findings #649

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion scripts/build-marketplace.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@
# marketplace/oddyssey/ (the materialized plugin the manifests
# point at: agents, commands, skills,
# plugin.json, .claude-plugin/plugin.json,
# .mcp.json, mcp.json, com.github.copilot/)
# .mcp.json, mcp.json, com.github.copilot/,
# LICENSE, SECURITY.md)
# Everything it writes is GENERATED - never edit those files by hand.
# Run by the release workflow after the version bumps, so the artifacts
# always carry the released version and the matching oddyssey-mcp pin.
Expand Down Expand Up @@ -150,6 +151,18 @@ if [ -f marketplace/oddyssey/hooks/hooks.json ]; then
done
fi

# Claude Code's default, declared for the plugin scanners that want it
# explicit: the plugin's own plugin.json is the authority. On every entry,
# where Claude Code reads it, and at the root, where the HOL scanner looks
# (Claude Code ignores it there).
jq '. + {strict: true} | .plugins |= map(. + {strict: true})' .claude-plugin/marketplace.json \
> "$TMP/marketplace.json"
cp "$TMP/marketplace.json" .claude-plugin/marketplace.json

# A scanner reads the plugin directory as a repository of its own: carry
# the repository's license and security policy into it.
cp LICENSE SECURITY.md marketplace/oddyssey/

cat > marketplace/README.md <<'EOF'
# GENERATED - do not edit

Expand Down
7 changes: 4 additions & 3 deletions tests/skills/odd-memory/test_odd_report.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1499,9 +1499,10 @@ def test_the_credential_rule_tells_a_value_from_its_wiring(report):
)
for text in wiring:
assert report.credential_in(text) is None, text
# the values a secret scanner would match are assembled at run time
values = (
"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.abcdefgh",
"token: ghp_16C7e42F292c6912E7710c838347Ae178B4a",
"token: " + "ghp_" + "16C7e42F292c6912E7710c838347Ae178B4a",
"InstrumentationKey=0a1b2c3d-0000-4000-8000-000000000001",
"--query instrumentationKey",
"api_key=sk-abcdefghijklmnopqrstuvwxyz0123",
Expand All @@ -1514,8 +1515,8 @@ def test_the_credential_rule_tells_a_value_from_its_wiring(report):
"`api_key: eyJrIjoiT0tTcE1tYVYifQ==`",
"**token: Zm9vYmFyYmF6cXV4MTIzNDU2Nzg5MA==**",
"| check | q | `api_key: eyJrIjoiT0tTcE1tYVYifQ==` | id |",
'api_key: "eyJrIjoiT0tTcE1tYVYifQ=="',
"token: 'ghp_16C7e42F292c6912E7710c838347Ae178B4a'",
'api_key: "' + "eyJrIjoiT0tTcE1tYVYifQ==" + '"',
"token: '" + "ghp_" + "16C7e42F292c6912E7710c838347Ae178B4a'",
)
for text in values:
assert report.credential_in(text), text
Expand Down