dev-flow

What the scan recorded

Observed events

every prompt, mcp__dev-flow__set calls, mcp__dev-flow__advance calls, mcp__dev-flow__approve calls, Bash calls, Edit|Write|NotebookEdit calls, mcp__redmine__update_redmine_issue calls

Hooks

session.start, ui.render {component=AbovePrompt}, prompt.submit, prompt.compose, tool.call {tool=mcp__dev-flow__set}, tool.call {tool=mcp__dev-flow__advance}, tool.call {tool=mcp__dev-flow__approve}, tool.call {tool=Bash}, tool.call {tool=Edit|Write|NotebookEdit}, tool.call {tool=mcp__redmine__update_redmine_issue}

API calls

$.clock.every, $.fs.read, $.fs.write, $.process.run, $.session.cwd, $.tool.register, $.ui.invalidate, $.ui.resolve, $.ui.status, $.ui.toast

Validation on 2.1.302

Passed

Scanned revision

c9a1e665900b

Marketplace warnings

dev-flow-local

UI rewrite review

UI hook source contains control-character strings. Review any values passed to next() as rewritten props.text; the scanner does not trace whether these strings reach that call. hooks/logic.ts:17, hooks/logic.ts:18, hooks/logic.ts:19

These are the hooks and API calls reported by claude plugin validate. Access levels describe the widest reach of those calls and are not safety ratings. Validation is a static check, not a runtime test, and a passing result does not prove that a mod works or is safe. How the scan works.