Development record
LoadRepoMeta reads .claude-plugin/plugin.json repository into an href on every emitted page with no executableScheme check, unlike its two sibling href sources, so a javascript: address (or a scheme-less typo) passes every gate and ships on every page.
issueresolvedminoriss-2608221456466438
LoadRepoMeta reads .claude-plugin/plugin.json repository into an href on every emitted page with no executableScheme check, unlike its two sibling href sources, so a javascript: address (or a scheme-less typo) passes every gate and ships on every page.
Frontmatter
| id | iss-2608221456466438 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608221456466438-loadrepometa-reads-claude-plugin-plugin.md
open on GitHub ↗ · commit history ↗