Presence is not the finding
A Claude plugin may legitimately bind hooks or declare local MCP servers. Installers need to know what runs on their machine before they click install. The defect is an undocumented surprise — not the existence of a hook that the product requires.
Security scorecards should treat the published surface as context for review, then raise backlog items when evidence shows a real risk or a missing disclosure.
What to put in the readme
For each hook: the event name, the command or script, and why it exists. For each local MCP server: the launch command and what data it can reach. One table beats a marketing paragraph.
If a hook is optional, say how to disable it. If it is required for the skill to work, say that too — installers will choose with eyes open.
What auditors should not demand by default
“Remove every hook” is rarely the right fix for a plugin whose value depends on lifecycle events. Prefer disclosure, least privilege, and pinned commands over deletion theater.
Reserve removal recommendations for hooks or MCP entries that exfiltrate, escalate, or cannot be justified against the plugin’s stated job.
Tie disclosure to the listing
Marketplace visitors skim the listing before the repo. Mirror the hooks/MCP table in the listing description or a linked SECURITY note so trust is earned before clone.
AuditHQ’s Claude plugin audits surface hooks and local MCP as part of the published inventory so authors and installers see the same map.