fix(security): pin marketplace plugins, SHA-pin workflows, env-var shell args

[avifenesh]

Summary

Internal audit (2026-04-26). 4 commits:

#	Severity	Finding	Fix
1	HIGH	20 marketplace sub-plugins used unpinned `main` at install time — any sub-plugin compromise ships code to every user	Pin to release tag + commit SHA via new `scripts/pin-marketplace.js`
2	MED	`agent-sh/.github@main` reusable workflow not SHA-pinned	SHA pinned
3	MED	`${{ inputs.version }}` interpolated into 5 shell blocks	Moved to `env:`
4	LOW	Self-referential npm dep `"agentsys": "^5.0.0"`	Removed

Marketplace pin status

• Tag+SHA pinned: next-task (v1.1.1), repo-intel (v0.2.0), onboard (v0.1.0), can-i-help (v0.1.0)
• SHA-only pinned (no matching `v` tag on remote): 16 plugins including agnix, ship, prepare-delivery, web-ctl, etc.

Once each sub-plugin cuts a proper `v` tag, re-run `node scripts/pin-marketplace.js` to upgrade SHA pins to tag+SHA pins.

Test plan

• `node -e "JSON.parse(...)"` marketplace.json — valid
• `js-yaml.load` for ci.yml + release.yml — valid
• No test suite present (pre-existing)

Follow-up

• After agent-analyzer/agnix/web-ctl land their security releases and cut tags, re-run `pin-marketplace.js` and ship agentsys v5.10.0 with upgraded pins.

---

Note

Medium Risk
Medium risk because it changes how marketplace plugins and reusable workflows are sourced (tag/SHA pinning) and tweaks release workflow shell variable handling, which could affect CI/release behavior if pins or env wiring are wrong.

Overview
Hardens supply-chain integrity for plugin installs and CI. Marketplace source: "url" entries in .claude-plugin/marketplace.json are now pinned to immutable refs by adding commit SHAs (and ref tags when available) instead of tracking default branches.

Adds scripts/pin-marketplace.js to automatically resolve v<version> tags to SHAs via gh, falling back to main’s HEAD SHA when no tag exists.

Locks down GitHub Actions usage. The reusable agnix workflow in ci.yml is SHA-pinned, and release.yml stops interpolating ${{ inputs.* }} directly in shell blocks by passing values via env variables. Also removes the self-referential agentsys dependency from package.json/package-lock.json.

^{Reviewed by Cursor Bugbot for commit 604bb16. Configure here.}

[gemini-code-assist]

Code Review

This pull request introduces a new script, scripts/pin-marketplace.js, which pins marketplace plugin entries to specific release tags and commit SHAs to enhance supply-chain security. It also removes the agentsys dependency from the project. Review feedback suggests improving the repository URL regex to handle trailing slashes, using HEAD instead of hardcoding main for default branch resolution, and adding error handling within the plugin processing loop to prevent the script from terminating on individual failures.

[Copilot]

Pull request overview

Security hardening changes from an internal audit to reduce supply-chain risk in plugin installs and CI workflows by pinning third-party references and avoiding unsafe workflow expression interpolation in shell.

Changes:

• Add scripts/pin-marketplace.js to automatically pin marketplace plugin sources to tag+SHA (or SHA fallback).
• Update .claude-plugin/marketplace.json to include commit SHAs (and tag refs where available) for all marketplace plugins.
• SHA-pin the reusable workflow reference in CI; remove self-referential agentsys npm dependency; move workflow inputs into env: for shell steps.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scripts/pin-marketplace.js	New pinning script to resolve tags/SHAs via gh and write pinned marketplace entries.
.claude-plugin/marketplace.json	Adds source.commit (and sometimes source.ref) to plugin entries for pinning.
.github/workflows/ci.yml	Pins agent-sh/.github reusable workflow to a commit SHA.
.github/workflows/release.yml	Moves version values from ${{ }} interpolation into env: variables inside shell steps.
package.json	Removes self-referential agentsys dependency.
package-lock.json	Removes the locked agentsys dependency entry accordingly.

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:70

• This step writes VERSION/TAG/NPM_TAG to $GITHUB_OUTPUT before any format validation. Because inputs.version is user-controlled on workflow_dispatch, newline characters could potentially inject additional outputs. Suggest validating/sanitizing INPUT_VERSION (reject \r/\n) before using it, and/or using the multiline-safe $GITHUB_OUTPUT heredoc format so untrusted values can't break the output file.

        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            # Tag push - extract version from tag
            TAG="${GITHUB_REF#refs/tags/}"
            VERSION="${TAG#v}"
          elif [ -n "$INPUT_VERSION" ]; then
            # Manual dispatch with version input
            VERSION="$INPUT_VERSION"
            TAG="v${VERSION}"
          else
            # Manual dispatch without version - use package.json
            VERSION=$(node -p "require('./package.json').version")
            TAG="v${VERSION}"
          fi
          if [[ "$VERSION" == *"-"* ]]; then
            PRE_ID="${VERSION#*-}"
            PRE_ID="${PRE_ID%%.*}"
            case "$PRE_ID" in
              beta) NPM_TAG="beta";;
              rc) NPM_TAG="rc";;
              *) NPM_TAG="next";;
            esac
          else
            NPM_TAG="latest"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "tag=${TAG}" >> $GITHUB_OUTPUT
          echo "npm_tag=${NPM_TAG}" >> $GITHUB_OUTPUT

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 604bb16. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.