mod-box

What the scan recorded

Footprint

Unavailable or incomplete. Recorded events and calls below may omit access.

Observed events

compaction, every tool call, every prompt, subagent spawns, classic hooks, Bash calls

Hooks

session.start, session.end, session.compact, turn.start, turn.complete, tool.call, prompt.submit, command.run, agent.spawn, config.set, ui.close, classic.SessionStart, classic.CwdChanged, classic.FileChanged, ui.render {component=Pane}, ui.render {component=AbovePrompt}, session.start, command.run {command=mod-box}, ui.render {component=Pane, requestId=mod-box-diff}, ui.render {component=Pane, requestId=mod-box-settings}, tool.call {tool=Bash}, ui.render {component=Pane}, ui.render {component=AbovePrompt}, session.start, command.run {command=secret-allow}, tool.call, ui.render {component=Pane, requestId=mod-box-secret-allow}, session.start, command.run {command=mask}, ui.render {component=AssistantMessage}, ui.render {component=UserMessage}, ui.render {component=ToolUse}, ui.render {component=ToolResult}, ui.render {component=ToolGroup}, ui.render {component=AbovePrompt}, session.start, tool.call {tool=Bash}, command.run {command=pkg-allow}

API calls

$.agent.list, $.audio.play, $.clock.after, $.clock.every, $.clock.now, $.clock.sleep, $.command.list, $.command.register, $.command.run, $.config.list, $.config.set, $.env.get, $.fs.exists, $.fs.list, $.fs.read, $.fs.stat, $.fs.write, $.model.complete, $.model.fork, $.process.run, $.process.spawn, $.prompt.fill, $.prompt.read, $.prompt.submit, $.session.append, $.session.compact, $.session.cwd, $.session.id

Surface modules

mods/filetree/hooks/rows.tsx

Validation on 2.1.308

Passed

Scanned revision

71dc4f78e524

Marketplace passed

mod-box

UI rewrite review

UI hook source contains control-character strings. Review any values passed to next() as rewritten props.text; the scanner does not trace whether these strings reach that call. mods/codebase-map/hooks/claudemd.ts:49, mods/codebase-map/hooks/claudemd.ts:67, mods/filetree/hooks/register.tsx:376, mods/filetree/hooks/register.tsx:482, mods/filetree/hooks/register.tsx:760, mods/filetree/hooks/register.tsx:955, mods/filetree/hooks/register.tsx:1042, mods/filetree/hooks/tree.ts:169, mods/filetree/hooks/tree.ts:208, mods/prompt-rail/hooks/index.tsx:844, mods/prompt-rail/hooks/index.tsx:955, mods/prompt-rail/hooks/index.tsx:1108

These are the hooks and API calls reported by claude plugin validate. Access levels describe the widest reach of those calls and are not safety ratings. Validation is a static check, not a runtime test, and a passing result does not prove that a mod works or is safe. What a mod can access and how the scan works.