[External Plugin]: shim-cli

Plugin name

shim-cli

Short description

Finds secrets and personal data locally, in your prompts and in the tool results the agent reads, and tells you what it found. In VS Code it reports, and with enforcement on it stops a prompt or denies a tool call before it runs; a result that has already reached the model is reported, never masked. No account, no network destination, no telemetry.

GitHub repository

GetSHIM/shim-cli

Plugin path inside the repository

plugins/shim-cli

Ref to review

v1.0.1

Commit SHA to review

4b68ff19c352e5281e863a5df0d0ad1814bc0dae

Version

1.0.1

License identifier

Apache-2.0

Author name

shim Engineering

Author URL

No response

Homepage URL

No response

Keywords

privacy
security
hooks

Additional notes for reviewers

I'm one of the maintainers. What each client was measured to grant is in docs/compatibility.md at this commit; the short version:

VS Code (measured on 1.137.0 with Copilot Chat 0.65.0) is the client this listing serves. shim reports what it finds in prompts and tool results. With enforcement turned on in its config it can stop a prompt at UserPromptSubmit or deny a tool call at PreToolUse. It never masks in VS Code. After a tool has run it can only report: a PostToolUse block was measured and the model still read the result.
In VS Code a read_file result reaches the hook as an empty tool_response, so file reads are checked by path only. run_in_terminal output arrives in full.
GitHub Copilot CLI loads the same com.github.copilot/hooks/hooks.json, but the command exits at once when COPILOT_CLI is set, so installing this plugin in Copilot CLI inspects nothing. Copilot CLI users get the hook from the PyPI package with shim install copilot. The Copilot app has not been tested.
If no Python 3.9+ is found or the hook fails, the prompt or tool call goes through uninspected. Detection is regex plus checksums, so expect false positives and misses.
macOS and Linux are the supported platforms; the hook commands run through sh.

v1.0.1 is an annotated tag (tag object c83249766a307c78a5a2e2533b95fa9598ceb371); the SHA above is the commit it points to.

Submission checklist

The plugin lives in a public GitHub repository.
The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
This submission follows this repository's contribution, security, and responsible AI policies.
This plugin is not already listed in the Awesome Copilot marketplace.

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

Plugin: shim-cli
Repository: https://github.com/GetSHIM/shim-cli
Ref: v1.0.1
SHA: 4b68ff19c352e5281e863a5df0d0ad1814bc0dae

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	26 day(s)
Repository activity	0 watchers; 0 forks
Repository counts	7 stars · 0 watchers · 0 forks · 2 open issues/PRs

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	✅ pass
canvas structure	⚪ not_run

spec compliance: pass
vally lint: pass
install smoke test: pass
version match: pass
ref/sha consistency: pass
canvas structure: not_run
overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

0 skill(s) linted

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-pI51Yr/copilot-home/.copilot/installed-plugins/external-plugin-intake/shim-cli/plugin.json.

Version match output

- v1.0.1: matched version "1.0.1" at "plugins/shim-cli/plugin.json".
- 4b68ff19c352e5281e863a5df0d0ad1814bc0dae: matched version "1.0.1" at "plugins/shim-cli/plugin.json".

Ref/SHA consistency output

source.ref "v1.0.1" resolves to the same commit as source.sha "4b68ff19c352e5281e863a5df0d0ad1814bc0dae".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "shim-cli",
  "description": "Finds secrets and personal data locally, in your prompts and in the tool results the agent reads, and tells you what it found. In VS Code it reports, and with enforcement on it stops a prompt or denies a tool call before it runs; a result that has already reached the model is reported, never masked. No account, no network destination, no telemetry.",
  "version": "1.0.1",
  "author": {
    "name": "shim Engineering"
  },
  "repository": "https://github.com/GetSHIM/shim-cli",
  "license": "Apache-2.0",
  "keywords": [
    "privacy",
    "security",
    "hooks"
  ],
  "source": {
    "source": "github",
    "repo": "GetSHIM/shim-cli",
    "path": "plugins/shim-cli",
    "ref": "v1.0.1",
    "sha": "4b68ff19c352e5281e863a5df0d0ad1814bc0dae"
  }
}

View workflow run

/reject Copilot harnesses already have built-in provisions for controlling tool use.

❌ External plugin rejected

A maintainer rejected shim-cli, and the submission issue has been closed.

Reason

Copilot harnesses already have built-in provisions for controlling tool use.

This issue is now closed and /rerun-intake will no longer reopen it. If you address the feedback, please open a new external plugin submission issue.

Navigation Menu

Repository navigation

[External Plugin]: shim-cli #3425

Plugin name

Short description

GitHub repository

Plugin path inside the repository

Ref to review

Commit SHA to review

Version

License identifier

Author name

Author URL

Homepage URL

Keywords

Additional notes for reviewers

Submission checklist

✅ External plugin intake passed

Reviewer signals

Quality gate summary

Canonical external.json payload

❌ External plugin rejected

Reason

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[External Plugin]: shim-cli #3425

Description

Plugin name

Short description

GitHub repository

Plugin path inside the repository

Ref to review

Commit SHA to review

Version

License identifier

Author name

Author URL

Homepage URL

Keywords

Additional notes for reviewers

Submission checklist

Activity

github-actions commented on Sep 20, 2026

github-actions commented on Sep 20, 2026

✅ External plugin intake passed

Reviewer signals

Quality gate summary

Canonical external.json payload

aaronpowell commented on Oct 12, 2026

github-actions commented on Oct 12, 2026

❌ External plugin rejected

Reason

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions