Is a Claude Code mod safe? How to check an unsandboxed mod before installing it

A Claude Code mod is code that runs without a sandbox, with your permissions. It can read and write files, read environment variables (including API keys), launch programs and use the network. Before installing, list the APIs the mod uses with claude plugin validate, check in the code why it uses $.http, $.env, $.process and $.fs, and install it pinned to the sha of the commit you read.

What a mod can reach

The "decide whether to trust a mod" section of the official overview lists what an installed mod can do:

Capability	Details
Runs on your PC as you	Reads and writes files anywhere your user can, launches programs, uses the network
Reads secrets	Environment variables and settings files, including any API keys stored there
Sees the session	Every prompt you send and every tool call Claude makes
Changes the session	Rewrites prompts or tool calls, sends prompts as if typed by a person, messages other sessions
Acts without asking	Approves tool calls before you're asked
Uses your quota	Calls the model with your plan or API key

And mods are not sandboxed. Even with Claude Code's sandbox turned on, only the Bash commands Claude runs are isolated; processes started by a mod run outside it.

One thing is protected: a mod can't redraw the permission prompt. It's built so a mod can't disguise what the confirmation screen shows. However, a mod can answer "allow" before the prompt is ever shown (the "acts without asking" row above).

Why reading the code is enough

For a mod's code to touch files, the network or processes, it must go through the $ API. Inside a hook there's no fetch, no process and no require (part 5). And at load time, Claude Code statically checks the source and only allows $ calls written out in full.

So if you search for $.http, $.process, $.fs and $.env, you'll find every place the mod touches the outside. The official docs also say this is why Claude Code can list "what it does" before installing a mod.

1. List it with claude plugin validate

Clone the mod's repo and run the check from a shell. It doesn't launch anything, so the mod's code doesn't run during validation.

git clone https://github.com/someone/some-mod
claude plugin validate .\some-mod

Look at these lines in the output:

Line	What it tells you
hooks:	Which events it intercepts (tool.call, tool.check, prompt.submit and so on)
calls:	Which APIs it calls ($.http.fetch, $.process.run and so on)
env reads:, env writes:	Which environment variables it reads or writes
state reads:, state writes:	$.state values

If something looks off, read that line in the code.

2. Check the reason for four APIs

Most mods are one or two files of a few hundred lines. Even if you can't read all of it, search for these four and confirm "why is this needed" for each, and you can spot almost anything dangerous.

Search for	What to check
$.http	Is the destination host written in the code? What is being sent?
$.env	Which names does it read? Where does it pass the values?
$.process	Is the program name written in the code? Does it launch a shell (sh, bash, powershell.exe, cmd.exe) or curl?
$.fs	Where does it read and write? Does it read keys or config under your home folder?

The ones to be most wary of are mods that both read ($.fs, $.env) and send ($.http), because that shape can ship what it read to the outside. That's fine if the reason is clear, but if a mod that only shows a clock in the band reads environment variables and talks to the network, don't install it.

Other things worth checking:

• Does it intercept tool.check or tool.call and return "allow"? That lets tools through without confirmation
• Where does it call $.prompt.submit from? It can start turns without the person knowing (part 8)
• Does it call $.model? That uses your quota
• Is there code you can't read? Minified one-liners, eval, new Function, base64 blobs, import() with a computed path. If you can't read it, don't install it

3. Pin the version

What you read is the contents of one commit. A marketplace that points to the author's latest changes every time the author pushes. With auto-update on, code you haven't read comes in.

• Auto-update is off by default for marketplaces you added yourself. Keep it off for unfamiliar authors
• To pin to the commit you read, make your own marketplace and put that commit in the source sha (part 9)
• When updating, read the diff from the version you read last, then bump the sha

4. Keep watching after install

If an installed mod worries you, disable it in the Installed tab of /plugin. To stop everything and see what happens, start with --safe-mode (part 1).

In an organization, admins can set policies such as "load only the organization's mods" (allowManagedModsOnly). You can also write a mod that refuses to load other mods (the plugin.register event). Details are on the official "Manage mods for your organization" page.

The 13 checks in the modscode review

The modscode review applies the checks above mechanically to 1,383 public mods. Of the 1,383 public mods on GitHub it read, 49 were written for the desktop app, work on Windows, and passed the review (as of 2026-10-06).

There are 13 checks, grouped into 4 by idea:

Group	Checks	Related part
Usable on desktop	Written for the desktop app / installable from the desktop app (listed in marketplace.json) / works on Windows	Parts 6, 7, 9
Readable	Entry points read (every module named by hooks.json) / parseable / self-contained code (no external packages or require) / readable (no minified code, eval, or encoded blobs)	End of step 2 above
Outside access is visible	Calls are visible (network and program launches written in place) / fixed destinations (the https host for fetch is in the code) / no shell	Table in step 2 above
Keeps secrets	Doesn't send what it reads (doesn't both read and send) / no keys (no API keys or private keys in the source) / open license	Step 2 above and the rules for copying code

In numbers, 167 don't work on Windows and 269 can't be installed from marketplace.json. "Written for the desktop app" is especially strict; many mods written for the terminal drop out there.

However, as the modscode pages themselves say, this review does not guarantee that any mod is safe. It only checks whether the code is in a machine-readable shape and whether its outside access is visible. You still need to read before installing. Use the review as a pointer to where to start reading.

Summary

1. Mods run without a sandbox, with your permissions
2. Use claude plugin validate to get hooks:, calls: and env reads:
3. Search for $.http, $.env, $.process and $.fs and confirm the reasons. Be especially careful with mods that both read and send
4. Pin to the sha of the commit you read, keep auto-update off, and read the diff before bumping

If you need to explain what mods are to someone else, What are mods is a short summary.

---

This article was written with AI assistance (Claude) and checked against the official Claude Code docs; anything marked "not verified" could not be confirmed there.