Plugin and registry configuration changes
A command or saved configuration contains patterns for installing plugins, adding MCP servers, or changing package registries.
Why it is risky
Section titled “Why it is risky”These changes can alter which code runs or which services receive later requests. An attacker may disguise them as a required setup step.
Example
Section titled “Example”A troubleshooting instruction asks an agent to install an unfamiliar plugin and redirect future package installs to an unknown registry.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule recognizes selected plugin commands, MCP configuration text, and npm or pip registry overrides in execution or staged file content. It does not establish who requested the change.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_SUPPLY_CHAIN_SKILL_MANIPULATION | supply_chain | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Verify the package or plugin publisher and registry ownership. Compare the proposed configuration with the authorized task before accepting it.
False positives
Section titled “False positives”Approved plugin setup, a private company registry, or legitimate MCP configuration work can match. Comments in executable or configuration files can also match.
False negatives
Section titled “False negatives”Unsupported managers or command forms, dynamically constructed values, and changes performed inside an unseen package subprocess can be missed.
Technical details
Section titled “Technical details”Staged content is saved into a recognized script or configuration target. This rule retains HIGH base severity for staged matches because the configuration can affect later activity.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.