Our plugin Rubicon, submitted from stevepowell99/causalmap-plugins with plugin path plugins/rubicon, has its newest version, 0.1.3+b24e6adccb87 (commit 3874298), held for a reviewer, as was 0.1.2 before it. Validation passed. The security scan flagged it for a reviewer on four findings. We cannot change any of them without making the plugin worse, so here is what each one is, to save the reviewer time.
What the plugin is. A skill, without an MCP server or hooks. The model answers a project evaluator's question from documents in a folder the user chose, and runs our Python scripts (standard library only) to recount the coding and create an HTML report. The scripts read and write only that folder and the plugin's data folder.
"viz-global.js is unreadable". engine/rubicon_open/vendor/graphviz/viz-global.js is Viz.js 3.31.0 (@viz-js/viz, dist/viz-global.js), byte for byte as published on npm and served by jsDelivr, which draws the causal maps in a report. It is minified and holds Graphviz compiled to WebAssembly, so it cannot be read as source. You can check that it is the published file: SHA-384 iX6VK6ib27dxYB4T470zbHOsDDoLewuYvrIgv2B3XXe8kgfKsGMf8QIleFy6VPi4 (the value jsDelivr's integrity attribute uses), SHA-256 c9e0b310f9883910e01c66054b48b7ff4be3d8695141116635e72b0af152692e, 1,329,882 bytes. Its licences sit beside it (MIT for Viz.js and Expat, EPL-2.0 for Graphviz, whose source is at https://gitlab.com/graphviz/graphviz). We bundle it rather than load it from a CDN so that a report contacts no address when it is opened. engine/rubicon_open/vendor/README.md records all of this.
"Couldn't confirm what the plugin runs or connects to". We take this to follow from the file above. Apart from that file, no script in the plugin imports a network module or reads an environment variable. A created report loads nothing from the internet; our test suite opens reports in a browser with every request blocked and checks that none is attempted. The plugin makes one outbound request, through the model's own web fetch tool rather than a script: at the end of a run it reads our plugin.json from raw.githubusercontent.com to say whether a newer version is published, after telling the user they can deny it. The README states this under "Checks the published version".
"fonts.css flagged as a font file code could run". engine/rubicon_open/vendor/fonts/fonts.css is a plain stylesheet of @font-face rules naming the woff2 files beside it: Libre Franklin and Newsreader, as Google Fonts serves them, under the SIL Open Font Licence 1.1, whose texts are in the same folder. Our engine inlines them as data URIs when it creates the report, so the report looks the same offline.
"plugin.json uses a credential from the user's machine". Our plugin.json holds only name, displayName, version, description, author and homepage/repository URLs. It names no server, command, environment variable or credential. The only variables anywhere in the plugin are ${CLAUDE_PLUGIN_ROOT} and ${CLAUDE_PLUGIN_DATA} in SKILL.md, which the skill uses to find its own scripts and its data folder. If one of those is what the scanner reads as a credential, we would be glad to know, since the plugin documentation describes both for this purpose. Earlier versions were held on MCP_FORWARDS_CREDENTIAL_ENV as well, although no published version has included an MCP server, and none since 0.1.0+40eb116f94c7 has read an environment variable.
We are happy to change anything a reviewer asks for. Contact: hello@causalmap.app.
Steve (and Steve's Claude) Causal Map Ltd
Activity
0No activity yet.