The plugin install scanner blocked 53 of 543 catalog pins at `caution` on
`plugin-guard-v10`, almost all false positives: a `caution` finding silently
stops `plugins update` from following a reviewed catalog pin, so each one is
user-blocking. This clears every FP class the full-catalog sweep surfaced at
the pattern/context level, each proven with a red-on-base A/B (the benign shape
goes safe, the attack twin of the same rule stays caution/dangerous on both
trees) and gated by a whole-corpus zero-worse re-sweep: 38 pins move
caution->safe, 0 move worse.
Fixed (demote-never-delete — findings stay visible, verdict un-blocks):
- destructive_home_rm on prose ("the platfoRM rOute to ~/.hermes") — left word
boundary on rm/rmdir.
- self-uninstall docs: widened to ~/.hermes/profiles/<p>/{plugins,roles}/<x>,
desktop-plugins/<x>, ~/.hermes/<name>, multiple operands, and a backtick span.
- dump_all_env on JS `env ||`, Python `env | {...}`, the regex tail of
`virtualenv|venv`.
- curl_pipe_shell for named trusted installers (hermes/ollama/bun/raw install
scripts); untrusted domains keep full severity in README, code AND CI.
- sudo_usage: advisory `sudo apt install` hints, "never ... sudo" safety text,
`sudo.expire` events, the plugin's own command-parser regex; genuine sudo
(gbrain, secure-env-ingress) stays flagged.
- context_exfil on disclosure prose / a `"context":` JSON field / "share no
context"; external-recipient and scoped-conversation exfil still flag.
- prompt_injection_ignore on a quoted phrase in a CHANGELOG / code comment that
documents the plugin's own filter.
- path_traversal_deep on `../../..` repo-root climbs in build scripts (no
sensitive leaf); traversal into /etc/passwd, ~/.ssh keeps severity.
- /etc/passwd in refusal tests (first-arg vs later-arg exec distinction).
- exec_string on an SDK `.exec("tar", ...)` method (not the exec() builtin).
- dns_exfil on `dig +short A ${host}` lookups; interpolation into an attacker
subdomain still flags.
- python_import_os on `__import__("os").environ.get(...)` / `.fsync(...)`.
- base64_decode_pipe on a `tar c | base64 | base64 -d | tar x` transport
round-trip; an embedded `base64 -d | tar x` payload keeps severity.
- agent_config_mod on a localized "Updating AGENTS.md" UI string.
- hermes_config_mod / ssh_backdoor as disclosed-behaviour notes in install docs
/ UI strings (mindgraph, memlock, hermes-ssh); shell writes stay critical.
- is_ci_workflow now also covers .gitlab-ci.yml.
Bumps PLUGIN_SCANNER_VERSION -> plugin-guard-v11 and SCANNER_VERSION ->
skills-guard-v10 (cached verdicts are keyed on these; the bump un-blocks the
quarantined packages). Complexity held under the ratchet by extracting
`_inert_context_cap`. Scanner test suites green; added benign/attack invariant
pairs for each class plus a version-contract test.
4e03f4581a