[External Plugin]: shim-cli · Issue #3425 · github/awesome-copilot · GitHub
Skip to content

[External Plugin]: shim-cli #3425

Closed
Closed
[External Plugin]: shim-cli#3425
Labels
external-pluginPublic external plugin submissionneeds-review:MEDIUMContributor reputation check flagged MEDIUM riskrejectedSubmission was rejected by a maintainer

Description

@DurthVadr
DurthVadr
opened on Sep 20, 2026

Plugin name

shim-cli

Short description

Finds secrets and personal data locally, in your prompts and in the tool results the agent reads, and tells you what it found. In VS Code it reports, and with enforcement on it stops a prompt or denies a tool call before it runs; a result that has already reached the model is reported, never masked. No account, no network destination, no telemetry.

GitHub repository

GetSHIM/shim-cli

Plugin path inside the repository

plugins/shim-cli

Ref to review

v1.0.1

Commit SHA to review

4b68ff19c352e5281e863a5df0d0ad1814bc0dae

Version

1.0.1

License identifier

Apache-2.0

Author name

shim Engineering

Author URL

No response

Homepage URL

No response

Keywords

privacy
security
hooks

Additional notes for reviewers

I'm one of the maintainers. What each client was measured to grant is in docs/compatibility.md at this commit; the short version:

  • VS Code (measured on 1.137.0 with Copilot Chat 0.65.0) is the client this listing serves. shim reports what it finds in prompts and tool results. With enforcement turned on in its config it can stop a prompt at UserPromptSubmit or deny a tool call at PreToolUse. It never masks in VS Code. After a tool has run it can only report: a PostToolUse block was measured and the model still read the result.
  • In VS Code a read_file result reaches the hook as an empty tool_response, so file reads are checked by path only. run_in_terminal output arrives in full.
  • GitHub Copilot CLI loads the same com.github.copilot/hooks/hooks.json, but the command exits at once when COPILOT_CLI is set, so installing this plugin in Copilot CLI inspects nothing. Copilot CLI users get the hook from the PyPI package with shim install copilot. The Copilot app has not been tested.
  • If no Python 3.9+ is found or the hook fails, the prompt or tool call goes through uninspected. Detection is regex plus checksums, so expect false positives and misses.
  • macOS and Linux are the supported platforms; the hook commands run through sh.

v1.0.1 is an annotated tag (tag object c83249766a307c78a5a2e2533b95fa9598ceb371); the SHA above is the commit it points to.

Submission checklist

  • The plugin lives in a public GitHub repository.
  • The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
  • This submission follows this repository's contribution, security, and responsible AI policies.
  • This plugin is not already listed in the Awesome Copilot marketplace.

Activity

  1. DurthVadr
    added
    external-pluginPublic external plugin submission
    awaiting-reviewSubmission is waiting for automated intake validation
    on Sep 20, 2026

  2. github-actions commented on Sep 20, 2026

    @github-actions
    github-actionsBot
    on Sep 20, 2026 – with GitHub Actions
    Contributor

    🟡 Contributor Reputation Check: MEDIUM risk

    Check Risk
    Profile MEDIUM
    Credential audit NONE

    Maintainers: please review this contributor before merging.
    See the workflow run for full details.
    Automated check powered by AGT.

  3. github-actions
    added
    needs-review:MEDIUMContributor reputation check flagged MEDIUM risk
    ready-for-reviewSubmission passed intake validation and is ready for maintainer review
    and removed
    awaiting-reviewSubmission is waiting for automated intake validation
    on Sep 20, 2026

  4. github-actions commented on Sep 20, 2026

    @github-actions
    github-actionsBot
    on Sep 20, 2026 – with GitHub Actions
    Contributor

    ✅ External plugin intake passed

    This submission passed automated intake validation and quality checks and is ready for maintainer review.

    Reviewer signals

    These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

    Signal Result
    Repository age 26 day(s)
    Repository activity 0 watchers; 0 forks
    Repository counts 7 stars · 0 watchers · 0 forks · 2 open issues/PRs

    Quality gate summary

    Legend: ✅ pass · ⚠️ warning · 🛑 fail

    Gate Status
    spec compliance (non-blocking) ✅ pass
    vally lint ✅ pass
    install smoke test ✅ pass
    version match ✅ pass
    ref/sha consistency ✅ pass
    canvas structure ⚪ not_run
    • spec compliance: pass
    • vally lint: pass
    • install smoke test: pass
    • version match: pass
    • ref/sha consistency: pass
    • canvas structure: not_run
    • overall: pass
    spec compliance output (✅ pass) 
    Agent Plugins v1.0.0 manifest checks passed for plugin.json.
    vally lint output (✅ pass) 
    0 skill(s) linted
    install smoke test output (✅ pass) 
    Install smoke test succeeded. Verified /tmp/external-plugin-quality-pI51Yr/copilot-home/.copilot/installed-plugins/external-plugin-intake/shim-cli/plugin.json.
    Version match output 
    - v1.0.1: matched version "1.0.1" at "plugins/shim-cli/plugin.json".
- 4b68ff19c352e5281e863a5df0d0ad1814bc0dae: matched version "1.0.1" at "plugins/shim-cli/plugin.json".
    Ref/SHA consistency output 
    source.ref "v1.0.1" resolves to the same commit as source.sha "4b68ff19c352e5281e863a5df0d0ad1814bc0dae".
    Canvas structure output 
    Canvas structure gate skipped because plugin is not tagged with "canvas".

    Canonical external.json payload

    {
  "name": "shim-cli",
  "description": "Finds secrets and personal data locally, in your prompts and in the tool results the agent reads, and tells you what it found. In VS Code it reports, and with enforcement on it stops a prompt or denies a tool call before it runs; a result that has already reached the model is reported, never masked. No account, no network destination, no telemetry.",
  "version": "1.0.1",
  "author": {
    "name": "shim Engineering"
  },
  "repository": "https://github.com/GetSHIM/shim-cli",
  "license": "Apache-2.0",
  "keywords": [
    "privacy",
    "security",
    "hooks"
  ],
  "source": {
    "source": "github",
    "repo": "GetSHIM/shim-cli",
    "path": "plugins/shim-cli",
    "ref": "v1.0.1",
    "sha": "4b68ff19c352e5281e863a5df0d0ad1814bc0dae"
  }
}

    View workflow run

  5. aaronpowell commented on Oct 12, 2026

    @aaronpowell
    aaronpowell
    on Oct 12, 2026
    Contributor

    /reject Copilot harnesses already have built-in provisions for controlling tool use.

  6. github-actions
    added
    rejectedSubmission was rejected by a maintainer
    and removed
    ready-for-reviewSubmission passed intake validation and is ready for maintainer review
    on Oct 12, 2026

  7. github-actions commented on Oct 12, 2026

    @github-actions
    github-actionsBot
    on Oct 12, 2026 – with GitHub Actions
    Contributor

    ❌ External plugin rejected

    A maintainer rejected shim-cli, and the submission issue has been closed.

    Reason

    Copilot harnesses already have built-in provisions for controlling tool use.

    This issue is now closed and /rerun-intake will no longer reopen it. If you address the feedback, please open a new external plugin submission issue.

  8. github-actions
    closed this as completedon Oct 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    external-pluginPublic external plugin submissionneeds-review:MEDIUMContributor reputation check flagged MEDIUM riskrejectedSubmission was rejected by a maintainer

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions