Admin Capability Lockdown

Mods enterprise 9 Scanned by NVIDIA SkillSpector

Install Command

npx claude-code-templates@latest --mod enterprise/admin-capability-lockdown

View on GitHub

claude-code — admin-capability-lockdown

Scanned by NVIDIA SkillSpector

Automated static analysis (no LLM) · v2.12.0 · 2026-10-17

Partial analysis: some checks could not run on this component.

3 observations

scanner score 36/100

SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.

Agent Config Directory Access
Agent Snooping · README.md:34
MCP server referenced without pinned version: 'npx claude-code-templates'.
MCP Rug Pull · README.md:43
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.
MCP Least Privilege · SKILL.md:1

Learn more about NVIDIA SkillSpector.

Content

Claude Mod. A mod is a complete Claude Code plugin built on function hooks (Anthropic's mods/ layout); it is on by default in Claude Code 2.1.287+. Hooks module: hooks/admin-capability-lockdown.ts. Options: allowedPlugins, refuseCalls, shellPolicy (set in user or managed settings pluginConfigs, or /config). Run claude plugin validate on the installed folder to see every event it hooks and every $ call it makes.

admin-capability-lockdown

An organization-level mod that (1) withholds the http and process nouns from $ so no plugin seated beneath it can reach the network or spawn processes, (2) refuses plugins at plugin.register by name allowlist and by the $ calls their source declares, and (3) optionally withholds or guards the Bash tool.

Only (1), (2) and the "deny" shell policy are real boundaries. The "guardrail" shell denylist is bypassable by design and is labelled as such.

SEATING. Withholding and refusal only bind the plugins BENEATH this one. Put it in the prepend tier through managed settings, e.g.

json

"prependPlugins": ["admin-capability-lockdown@acme-tools", "sec-default@builtin"]

so it is outermost: its engine.create step returns last (its withholding wins) and it judges every plugin.register after it. Loaded with --plugin-dir it sits in the user tier and only binds plugins listed after it.

If a check itself fails (it throws or runs out of its time budget), a user plugin is refused and a guardrail-mode command is denied, never let through unchecked. The engine.create step has no time budget; a failure there fails the load.

Options

  allowedPlugins: string  plugin names that may register, comma-separated (unset = any name)
  refuseCalls:    string  a user-tier plugin whose source calls any of these is refused, comma-separated
                            (default: the withheld nouns' calls, e.g. "http.fetch", "process.run")
  shellPolicy:    "deny" | "guardrail" | "allow"  (default "deny")

Declared in .claude-plugin/plugin.json (userConfig). Set them in /config, in user settings (~/.claude/settings.json, not project settings), with --settings <file> or in managed settings:

json

{ "pluginConfigs": { "admin-capability-lockdown@skills-dir": { "options": { } } } }

Install

npx claude-code-templates@latest --mod enterprise/admin-capability-lockdown
claude

It is written to .claude/skills/admin-capability-lockdown/, which Claude Code auto-loads as admin-capability-lockdown@skills-dir. For one session with hot reload: claude --plugin-dir .claude/skills/admin-capability-lockdown. claude plugin validate .claude/skills/admin-capability-lockdown prints every event it hooks and every $ call it makes.

Requirements. Mods are on by default in Claude Code 2.1.287+. Typed against Anthropic's declarations: https://github.com/anthropics/claude-code/tree/main/mods