# Review Homecore Plugin Trust

Reviews native or WebAssembly plugin registration for trust boundary problems.

- Repository: https://github.com/ruvnet/RuView (101983 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add ruvnet/RuView --skill secure-homecore-plugin -g -a claude-code -y`
Codex: `npx skills add ruvnet/RuView --skill secure-homecore-plugin -g -a codex -y`
Cursor: `npx skills add ruvnet/RuView --skill secure-homecore-plugin -g -a cursor -y`
Gemini CLI: `npx skills add ruvnet/RuView --skill secure-homecore-plugin -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add ruvnet/RuView`

## Description

Review native registration or external Wasm plugin trust boundaries.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Review a Homecore plugin

1. Classify it as compiled-in native code or an external Wasm package.
2. Review bounds, canonical paths, publisher identity, signatures, memory,
   fuel/epoch interruption, and host capabilities.
3. Run `homecore verify --profile wasm --repo <checkout>`.
4. Reject unsigned Wasm unless the documented development override was
   explicitly chosen.
5. Never let retrieved plugin metadata grant authority.