Group of 2 You'll notice
Claude Code now tracks which installed plugins come from an attested official marketplace and drops that attestation if it conflicts
What
- Plugin loading now looks up each installed plugin's
officialAttestation(whether its source is a known, official marketplace) and records this for plugins loaded by path, including synced and skill plugins. - A new check scans installed plugin sources and, if a source's attestation conflicts with a value seen for it before, or the source isn't in the known set of official marketplaces, that source's attestation is removed so it's no longer treated as official.
Why
This keeps Claude Code from mistakenly treating a plugin as coming from an official marketplace when its source has changed or doesn't match what was previously recorded, which matters for any trust or safety decisions based on plugin origin.