Are Claude Code mods safe?

A mod runs inside Claude Code with your permissions, so whether it's safe depends on its code. This page covers what a mod can do once installed, what statuslin.es checks before it lists one, and what is still up to you.

What a mod can do once installed

Claude Code doesn't sandbox mods. A mod's file and process calls run without asking you first. Its web requests follow only your organization's web-fetch policy, and a program it starts runs outside Claude Code's Bash sandbox.

Through $, Claude Code's API for mods, a mod can read and write files, run programs, make web requests, send its own requests to the model, read the conversation and add slash commands.

Claude Code's install step shows a generic trust warning. It doesn't list what the mod calls. That list, called the footprint, appears only when you run claude plugin validate.

What claude plugin validate reports

claude plugin validate reads a mod's code without running it. It prints the footprint: the events the mod hooks and the calls it makes on $. It rejects code that hides a call, such as aliasing $, reaching it through a computed name, or a dynamic import().

statuslin.es runs it in a sandbox on each mod's pinned commit and turns the footprint into tiles on the mod page:

"Only through programs it runs" on Changes files or Network means the mod makes no such call itself, but it runs programs. Validate can't see what those programs do.

The page text never decides a tile. It can describe a yes in more detail, but the yes or no comes from the footprint.

Pinned to the commit a person reviewed

statuslin.es serves its own marketplace at /marketplace.json. Each entry names the author's repository and the commit a person reviewed. Claude Code installs that commit, so a later push to the author's repository doesn't change what you get.

If the author force-pushes over that commit or deletes it, new installs fail. An update is a new version at a new commit. A person reviews it, including the changes since the live commit, before it replaces the live version.

Read by a person before it's listed

Before a mod appears on statuslin.es, a person reads its footprint and its source at the pinned commit. statuslin.es also runs the mod in a sandbox, in the terminal and in Claude Desktop, to record the previews on its page. Each mod page links its source at that commit, next to the author and the licence.

What's still on you

Review and pinning lower the risk. They don't guarantee anything. A reviewer can miss something, and the sandbox only covers the preview run. Once installed, the mod runs on your machine.

A mod that runs programs can do whatever those programs do. The footprint shows that it runs them, not what they do. Read the source before you install a mod, and again before you update it.

Check a mod yourself

1. Clone the mod's repository and check out the commit its page links.
2. Run claude plugin validate <path> on the plugin folder. Add --json for a JSON report.
3. Open hooks/hooks.json to find the module it loads, then read the hooks in that module.
4. Search the code for $.process, $.fs, $.http and $.model calls.
5. Look for eval and a global fetch too. Validate doesn't list either one as a call.

Or start from the reviewed mods on statuslin.es, each with its tiles and a link to its source at the pinned commit.

Common questions