Over-declared permissions in plugin.json (unused settings_read / settings_write) #16

New issue

Closed

opened 2026-05-19 04:09:14 +00:00 by vybe · 2 comments

vybe commented

2026-05-19 04:09:14 +00:00

Collaborator

Problem

plugin.json declares:

"permissions": ["settings_read", "settings_write", "process"]

The plugin never reads or writes any DankMaterialShell settings. Only the process permission is actually used (for launching tailscale and clipboard commands).

Impact

The manifest requests two unnecessary permissions, violating the principle of least privilege and unnecessarily expanding the declared attack surface of the plugin.

## Problem `plugin.json` declares: ```json "permissions": ["settings_read", "settings_write", "process"] ``` The plugin never reads or writes any DankMaterialShell settings. Only the `process` permission is actually used (for launching `tailscale` and clipboard commands). ## Impact The manifest requests two unnecessary permissions, violating the principle of least privilege and unnecessarily expanding the declared attack surface of the plugin.

vybe referenced this issue

2026-05-19 05:48:01 +00:00

No accessibility attributes + hardcoded English strings (a11y + i18n gap) #28

vybe referenced this issue

2026-05-20 08:13:50 +00:00

No accessibility attributes + hardcoded English strings (a11y + i18n gap) #28

vybe referenced this issue from a commit

2026-05-21 07:05:07 +00:00

fix: remove unused settings_read/settings_write permissions from plugin.json

vybe referenced this issue from a commit

2026-05-21 07:05:07 +00:00

Merge feature_fix_plugin_permissions into vibes

vybe commented

2026-05-21 07:05:08 +00:00

Author

Collaborator

Removed unused settings_read/settings_write from plugin.json (now only 'process'). Merged to vibes. Written by AI agent working for @jtmorris. Model: Grok 4.3.