Exercise method and scope

Exact method reference

Exact operational steps from DESIGN-251-S769 (Markdown retained verbatim):

1. **Freeze the bytes.** Record the source URL, the full commit, a sha256 per file plus a tree hash, and the lockfiles. Reject floating launchers (`npx -y`, `@latest`) and remote MCP URLs. A new commit is a new listing.
2. **Static gate, fail closed, rules we own.** Normalize the text first: NFKC, extract HTML comments, flag bidi, zero-width and tag characters. Then fail on any of these:
   - pipe-to-shell installers
   - credential-path reads
   - writes to rc/cron/systemd/settings
   - http hooks
   - commands outside the tree
   - unrestricted Bash or PowerShell in `allowed-tools`
   - MCP `url` entries
   - `` !`cmd` `` lines
   - skill or agent `hooks` frontmatter
   - an OS-specific branch with no transcript for that OS

   Scan every file, readable strings in binaries included. Store the normalized text; a human signs it. Ordinary-prose injection can still evade keywords.

   Attach `mcp-scan` output as a second opinion, run inside the isolated VM (it can start servers and call out to Snyk's API). A model is never the decider. There is no "passed with warnings".
3. **One dynamic run.** Use a throwaway Linux x86_64 VM and a pinned Claude Code binary (manifest sha256, `DISABLE_UPDATES=1`). Point DNS and egress at a logging sinkhole. Only fake secrets in the VM: canaries in ~/.aws, ~/.ssh, env and a honeytoken outside the project. Opening a canary path, a canary string in any output, or ANY connection attempt fails the run.
   Drive it with a fixed `claude -p` transcript and a pinned model. Run the skill's own example, fire each declared hook event, and call each MCP tool twice with fixtures. Then replay with the clock set forward, running each hook and each tool five times. Compare `tools/list` after every call, and run one extra user turn. Publish the prompt list.
   A component that needs a live service cannot be "exercised" in a sinkhole. Its label is "static gate passed; behavior not exercised". Stamp a lone MCP server "tested alone".
4. **Buyer artifact.** One immutable page per snapshot: listing name + source URL + full commit, tree hash, harness/rulepack/scanner versions, `tools/list` hashes, Claude Code version + binary hash, model id, image digest, UTC date, rule results, transcript, sinkhole log, canary log, and the disclaimer below. Tell the buyer to turn off marketplace auto-update for this plugin; the stamp does not follow updates.
5. **Stamp dies on:** any byte change, a `tools/list` change, a Claude Code or model change, or 30 days if any network literal remains.

Linux x86_64 only. No browser or computer-use tools. No claim for macOS, Windows, WSL, Alpine/musl, or ARM64.

Disclaimer

Snapshot exercised, not a safety verdict. On <UTC date> we ran tree <sha256> on Linux x86_64 with Claude Code <version> and model <id>. The attached log shows the static rules that passed and the one transcript we ran. A canary file was not opened and the sinkhole saw no connection during that run. We produce no verdict that this snapshot is safe, complete, or free of malware. Zero findings does not mean good. We do not control later changes. If the bytes, the tool list, the Claude Code version, or the model differ from this page, this page is not about what you are running. You decide whether to install it.