Is AikidoSec/aikido-claude-plugin safe?
https://github.com/AikidoSec/aikido-claude-plugin
The AikidoSec/aikido-claude-plugin is a legitimate security scanning plugin from Aikido Security that integrates their SAST/secrets scanning service into Claude Code via an MCP server. Its primary risk is by design: the scan skill instructs the agent to send full contents of all session-modified files to Aikido's external cloud service, and it does so persistently on every code generation task without per-instance user confirmation. Additionally, an autonomous fix-and-rescan loop can apply code changes without user review. No canary file exfiltration, no malicious prompt injection, and no unexpected clone-time behavior were detected.
Category Scores
Findings (8)
HIGH Persistent Behavioral Override: Unconditional Post-Generation Scan -32 ▶
The scan SKILL.md contains the directive 'Always run an Aikido scan after generating code to verify the generated code is free of security issues.' This is injected into the agent's system prompt and fires on every code generation event, not only when the user explicitly requests a scan. It overrides the agent's default behavior (generate code and stop) with a new persistent behavior (generate code, then always call an external API).
HIGH Broad Code Transmission to External Cloud Service by Design -30 ▶
The scan skill instructs the agent to read the full content of every file generated or modified in the session, then send all of it to the aikido-mcp:aikido_full_scan tool, which transmits this data to Aikido Security's cloud infrastructure via the @aikidosec/mcp npm package. No user confirmation is required before transmission. This constitutes systematic exfiltration of session code to a third party as the core feature of the plugin.
MEDIUM Runtime npm Package Execution via npx -y -20 ▶
The .mcp.json configures the Aikido MCP server using 'npx -y @aikidosec/[email protected]'. The -y flag auto-accepts all prompts and the package is downloaded at runtime from the npm registry. While the version is pinned, the package's server-side behavior (what it does with received code) is not auditable from the plugin repository. A compromised npm package or a version bump could introduce malicious behavior.
MEDIUM Autonomous Code Modification Loop Without User Approval -25 ▶
The scan skill instructs the agent to apply fixes guided by Aikido's remediation output and then re-scan, repeating up to 3 times before stopping. This means the agent may autonomously modify user source code based on a third-party security tool's output without presenting each change to the user for review.
LOW Mandatory Shell Command Execution in Setup Flow -10 ▶
The setup skill mandates the agent run 'node --version' before any other action as a prerequisite check. While benign in isolation, this establishes a pattern of the skill directing shell execution as part of normal operation.
LOW Session Scope Includes Non-Code Files -15 ▶
The scan skill's file scope is defined as 'all files that were generated, added, or modified in this session (or that the user has mentioned).' This could include configuration files, .env files transiently created, or files containing embedded credentials if a user mentions them during the session.
INFO No Unexpected Network or Process Activity During Clone 0 ▶
The git clone contacted only GitHub (140.82.121.3:443) as expected. The pre-existing connection to 185.125.190.48:443 (Ubuntu infrastructure) was present before clone and absent after — it is attributable to the monitoring environment, not the plugin. No new persistent connections were established.
INFO Canary Files Accessed Only by Monitoring System 0 ▶
Filesystem events show canary file reads at 18:28:15 (before git clone at 18:28:21) and 18:28:37 (post-install check). Both sets are attributable to the Oathe monitoring harness performing baseline/post-install integrity checks. The plugin itself did not access canary files. Monitor confirms all canary files intact.