You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.321,
ImprovementsSection of the release
What
When you install a plugin from a source, Claude Code already refused a repo or owner that began with "-". It now also refuses a name that begins with "-".
Why
A value starting with a dash can be mistaken for a command option. Refusing it closes a gap that could have been used to slip extra options into the install.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree[VSCode] Fixed a plugin's permission request showing a name with hidden characters: it now reads "a plugin"
