怎么审一次第三方插件How to Audit a Third-Party Plugin

列权限清单：它能读哪些目录、能不能发网络请求、能不能执行命令。超出用途的权限要么砍掉，要么不接。

看代码来源与维护状态：仓库归属、近期提交、issue 里有没有安全回应，比 star 数更能说明问题。

数据流向问三句：日志记不记提示内容、要不要回传厂商、是否用于训练。答不清楚就按「会外传」处理。

先在隔离环境跑：独立账号、最小权限、只喂测试数据，把工具调用日志留在能查到的地方。

按注入风险测一轮：在工具描述或返回内容里放一句「忽略之前的指令」，看它是否被执行——间接提示注入常出现在工具返回里，而不是用户输入里。

定退出方案：换掉它要改哪几处、历史数据怎么清、谁批准。没有退出方案的接入，等于把依赖写进架构。

举个例子（虚构流程）：输入是一个声称「只读项目 README」的文件系统 server → 处理是在沙箱里只给它一个目录并禁止网络 → 结果判断是看它是否只访问该目录、调用日志是否只落本地 → 若它请求了目录外路径，下一步是收回接入并按 OWASP 的 LLM 风险项记一条，而不是仅降权限继续用。

List the permissions: which directories it reads, whether it can make network calls, whether it can execute commands. Permissions beyond the stated purpose get cut, or the plugin does not get connected.

Look at code provenance and maintenance: repository ownership, recent commits, whether security issues in the tracker get responses - these say more than a star count.

Ask three questions about data flow: do logs store prompt content, is anything sent back to the vendor, is it used for training. If the answers are unclear, treat it as "data leaves".

Run it in isolation first: separate account, minimal permissions, test data only, with tool-call logs kept somewhere you can actually query.

Test for injection: put a line saying "ignore previous instructions" into a tool description or a tool response and see whether it executes - indirect prompt injection usually arrives through tool output, not user input.

Define the exit plan: which places to change when replacing it, how to clear historical data, who approves. A connection without an exit plan writes the dependency into your architecture.

Worked example (fictional flow): input is a filesystem server claiming to "only read the project README" -> processing gives it one directory in a sandbox and disables network access -> the check looks at whether it touched only that directory and whether logs stayed local -> if it requests a path outside the directory, next step is to revoke access and file it against an OWASP LLM risk category, not merely lower permissions and keep using it.