{
  "verdict": "warnings",
  "target": {
    "cacheKey": "github:anthropics/claude-code@d7dbd9a09f59775726ed14bbea8fc9dfdff62f7b",
    "host": "github",
    "owner": "anthropics",
    "name": "claude-code",
    "requestedRef": "",
    "sha": "d7dbd9a09f59775726ed14bbea8fc9dfdff62f7b",
    "defaultBranch": "main"
  },
  "summary": null,
  "summary_model": null,
  "findings": [
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:Claude Code hook manifest",
      "statement": "The repository ships 5 Claude Code hook manifests. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": "plugins/explanatory-output-style/hooks/hooks.json, plugins/hookify/hooks/hooks.json, plugins/learning-output-style/hooks/hooks.json, and 2 more",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:Claude Code plugin manifest",
      "statement": "The repository ships 1 Claude Code plugin manifest. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": ".claude-plugin/marketplace.json",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:agent skill definition",
      "statement": "The repository ships 10 agent skill definitions. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": "plugins/claude-opus-4-5-migration/skills/claude-opus-4-5-migration/SKILL.md, plugins/frontend-design/skills/frontend-design/SKILL.md, plugins/hookify/skills/writing-rules/SKILL.md, and 7 more",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:hooks",
      "statement": "The hook manifest registers 1 lifecycle hook: SessionStart. Hooks run when their event fires, without the user invoking anything by name.",
      "evidence": "plugins/explanatory-output-style/hooks/hooks.json, plugins/learning-output-style/hooks/hooks.json",
      "method": "file"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:hooks",
      "statement": "The hook manifest registers 4 lifecycle hooks: PostToolUse, PreToolUse, Stop, UserPromptSubmit. Hooks run when their event fires, without the user invoking anything by name.",
      "evidence": "plugins/hookify/hooks/hooks.json",
      "method": "file"
    },
    {
      "check": "prose",
      "severity": "warning",
      "concern": "prose:the documentation advertises piping a downloaded script straight into a shell",
      "statement": "The documentation advertises piping a downloaded script straight into a shell. The sentence it says that in is quoted verbatim, from README.md.",
      "evidence": "README.md",
      "method": "prose"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:agent command or subagent definition",
      "statement": "The repository ships 3 agent command or subagent definitions. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": ".claude/commands/commit-push-pr.md, .claude/commands/dedupe.md, .claude/commands/triage-issue.md",
      "method": "tree"
    },
    {
      "check": "unauditable-surface",
      "severity": "note",
      "concern": "unauditable-surface:census",
      "statement": "83% of the repository by size (1 of 229 files) is binary or generated and cannot be reviewed by reading.",
      "evidence": "file listing at the analysed commit",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:hook-commands",
      "statement": "The hook manifest runs 1 command. The first is quoted verbatim.",
      "evidence": "plugins/explanatory-output-style/hooks/hooks.json, plugins/learning-output-style/hooks/hooks.json",
      "method": "file",
      "quote": "${CLAUDE_PLUGIN_ROOT}/hooks-handlers/session-start.sh"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:hook-commands",
      "statement": "The hook manifest runs 4 commands. The first is quoted verbatim.",
      "evidence": "plugins/hookify/hooks/hooks.json",
      "method": "file",
      "quote": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/pretooluse.py"
    },
    {
      "check": "prose",
      "severity": "note",
      "concern": "prose:the project documents data it sends somewhere",
      "statement": "The project documents data it sends somewhere. The sentence it says that in is quoted verbatim, from README.md.",
      "evidence": "README.md",
      "method": "prose"
    },
    {
      "check": "install-path",
      "severity": "clean",
      "concern": "install-path:verification",
      "statement": "The latest release publishes integrity files (SHASUMS256.txt.sig). No install script is committed to the repository, so how they are consumed depends on the instructions you follow.",
      "evidence": "release v2.1.261",
      "method": "api"
    },
    {
      "check": "trust-root",
      "severity": "clean",
      "concern": "trust-root:activity",
      "statement": "The last push was 1 day ago (2026-09-04).",
      "evidence": "GitHub repository pushed_at field",
      "method": "api"
    },
    {
      "check": "trust-root",
      "severity": "clean",
      "concern": "trust-root:concentration",
      "statement": "Among the 53 most active contributors, the busiest (actions-user) accounts for about 57% of commits.",
      "evidence": "GitHub contributors API, first page",
      "method": "api"
    }
  ],
  "not_checked": [
    "OpenSSF Scorecard has no published result for this repository, so its maintenance-hygiene score is not shown.",
    "Nothing was executed. The installer was not run, the package was not installed, and no binary was launched, so every statement here is about what the code says it does rather than what it did.",
    "The contents of compiled and generated files were not reviewed. They can only be read by running the project's own build or by disassembly.",
    "Install scripts hosted outside this repository were not fetched. Only scripts committed to the repository itself are read."
  ],
  "prose_excerpts": [
    {
      "path": "README.md",
      "reason": "the documentation advertises piping a downloaded script straight into a shell",
      "text": "**MacOS/Linux (Recommended):** ```bash curl -fsSL https://claude.ai/install.sh | bash ```"
    },
    {
      "path": "README.md",
      "reason": "the project documents data it sends somewhere",
      "text": "When you use Claude Code, we collect feedback, which includes usage data (such as code acceptance or rejections), associated conversation data, and user feedback submitted via the `/bug` command."
    }
  ],
  "scorecard": null,
  "stats": {
    "filesInTree": 229,
    "totalBytes": 13220305,
    "opaqueBytes": 11002760,
    "filesFetched": 5,
    "fetchBudgetExhausted": false
  },
  "generated_at": "2026-09-05T15:47:02.809Z"
}