You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Plugins SecurityArea: what it touches
Bug FixesKind: in v2.1.267,
Bug FixesSection of the release
What
When a plugin marketplace entry's file path fails Claude Code's containment check, the explanation now also flags paths containing backslashes as invalid, in addition to the previously flagged absolute paths, paths that climb out of their directory, network-shaped paths, and paths that traverse symlinks.
Why
This closes a gap where a backslash-containing path could otherwise slip past validation meant to keep marketplace entries confined to their intended directory.
