Developer audits permissions of 891 public Claude Code plugins

On November 6, 2026, a developer writing on DEV Community described cloning 891 public Claude Code mods and running claude plugin validate on each one to read its permission declarations. According to the article, the analysis found that most mods request access well beyond what a simple status bar widget would need. It also stressed that mods run without isolation and inherit the user's permissions, so it recommended checking two lines before installing. The calls: line shows what a mod can reach — files, programs, the network, your environment variables. The hooks: line shows what it gets to see — every tool call, every prompt, and the stored conversation. The command reads the code without running it, the author noted, which makes it safe to use on a mod you don't yet trust. The piece adds that mods arrived in Claude Code 2.1.287 in October (the year and exact date are cut off in the source). The post offers no further breakdown of the findings — only the aggregate count of mods and the general pattern of over-broad permission requests — and no follow-up has been reported. This stands as the sole write-up on the topic so far, so the broader implications of the audit remain to be seen.