Are Claude Code mods safe?
A mod runs inside Claude Code with your permissions and no sandbox. Whether it's safe depends on its code, and on who has read that code.
What a mod can do once installed
Through $, Claude Code's API for mods, a mod can do all of these:
- Reads and writes your files
- Runs programs
- Makes web requests
- Reads your environment variables
- Calls Claude and uses your tokens
- Reads the conversation
- Adds slash commands
- Approves Claude's tool calls for you
None of these asks you first
Claude Code's sandbox covers the commands Claude runs, not a mod or the programs a mod starts.
What claude plugin validate reports
claude plugin validate reads a mod's code without running it and prints its footprint: the events it hooks and the $ calls it makes. Claude Code won't load a mod whose calls validate can't read.
statuslin.es runs it on each mod's pinned commit and shows the footprint as tiles on the mod page:
| Attribute | What it says |
|---|---|
| Uses your tokens | Yes when the mod sends its own requests to Claude. |
| Changes files | Yes when it calls a file function that can write. Reading files doesn't count. |
| Network access | Yes when it makes its own web requests. |
| Slash commands | The slash commands it adds, by name, or None. |
"Only through programs it runs" on Changes files or Network access means the mod makes no such call itself but runs programs, and validate can't see what those programs do. The tiles come from the footprint, never from the page's text.
What statuslin.es checks before listing a mod
- Each mod is reviewed at one commit: its footprint and its source.
- statuslin.es's marketplace, /marketplace.json, pins that commit, so a later push to the author's repository doesn't change what you install.
- An update is a new commit, and its changes are reviewed before it goes live.
- If the author deletes the pinned commit, new installs fail.
How statuslin.es checks mods and status lines walks through each step with real examples.
What's still on you
- Review and pinning lower the risk but guarantee nothing.
- A reviewer can miss something.
- Read the source before you install a mod, and again before you update it.
Check a mod yourself
- 1
Clone the mod's repository
Check out the commit its page links.
- 2
Read its footprint
Run claude plugin validate <path> on the plugin folder and read its calls: line.
- 3
Read its hooks
Open hooks/hooks.json to find the module it loads, then read the hooks in that module.
- 4
Trace its calls
Find where the code calls $.process, $.fs, $.http, $.env and $.model, and read what it does with each.
Or start from the reviewed mods on statuslin.es. Each page shows its tiles and links its source at the pinned commit.
Common questions
Are Claude Code mods sandboxed?
No. A mod runs inside Claude Code with your permissions, and its file and process calls don't ask first. A program it starts runs outside Claude Code's Bash sandbox.
Does a statuslin.es preview mean a mod is safe?
No. statuslin.es records each preview by running the mod in a sandbox. That run shows what the mod draws. It does not check what the mod would do on your machine.
Can my organization limit which mods run?
Yes. Claude Code's admin settings include allowManagedModsOnly, strictKnownMarketplaces and disableAllHooks. Anthropic's mods admin docs describe each one.