Skip to main content

Module plugin_exec

apollo

Module plugin_exec 

Source
Expand description

Running tools declared by a host plugin manifest.

§Why this is deny-by-default

A host plugin is a directory apollo found. Turning a manifest in a found directory into an executable the agent can call means anything that can write a file into plugins/ gets code execution — which is the prompt injection to persistent execution path in AGENTS.md section 10, arrived at from the other side.

So discovery grants nothing. A manifest’s tools are only built if its plugin id appears in plugin_layer.trusted_host_plugins, which is empty by default. Enabling the feature at all is not enough; each plugin is named.

Within that gate the execution is still narrow:

  • the command is executed directly, never through a shell, so there is no quoting or metacharacter surface;
  • JSON arguments arrive on stdin, not argv, so a crafted argument cannot turn into another flag or another command;
  • the working directory is the plugin’s own directory;
  • the run is bounded by a timeout and the captured output is truncated.

Structs§

HostPluginToolAdapter
A manifest-declared command, exposed to the agent as a tool.