[Bug] False Positive with Windows Defender

[ash-bluepollution95]

What's broken?

Struggled to even install it properly either way - Windows wouldn't let me run the cli commands complaining that Claude Code didn't exist.

Went and installed it via Claude's tooling, and i made a hiccup in the commands.. that was fine Claude said to just remove the folder..

Upon RECYCLING starting beforei even get to emptying recycle bin.. sadly the Penetration Testing readme that contained totally FINE AND SAFE EXAMPLE CODE.. ina MARKDOWN ..

ThAT WAS NOT executable at all XD

... literally flipped this:
Backdoor:PHP/Perhetshell.B!dha

I dont even udnerstand how that... I"m not even RUNNING PHP locally!
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:PHP/Perhetshell!dha&ThreatID=2147950007

Anyways, i'm sure your product is safe, that's not my issue nro is it directly with you, but i did struggle to install it and i have high levels of anxiety when things don't install easily and after having to hear Windows PANIC at me about a virus (I hate windows but i Have no choice almost) -- I'm probably for now going to avoid trying to install the CLI again.

I know EXACTLY sadly which readme it was lol, "claude\plugins\marketplaces\jeremylongshore-claude-code-plugins\plugins\security\penetration-tester\README.md"

I'll eventually figure it out, but if there's any way you can teach an AV to stop doing that that'd be amazing.

Plugin Name

penetration-tester

Claude Code Version

2.1.39

[jeremylongshore]

Fixed in penetration-tester v2.0.0

The entire plugin has been rebuilt from the ground up to resolve this. Here's what changed:

Root cause: The old README contained literal PHP webshell example payloads (in markdown code blocks) that Windows Defender correctly flagged as Backdoor:PHP/Perhetshell.B!dha. While the code was non-executable markdown, AV scanners pattern-match on raw content regardless of file type.

What was removed:

• All literal exploit payloads and PHP code from README.md
• All three boilerplate stub scripts (pentest.sh, exploit_database.py, report_generator.py) that were cookie-cutter fakes
• Empty placeholder directories (assets/, references/ stubs)

What was added (real, working tools):

• security_scanner.py (1,166 lines) — HTTP security header analysis, SSL/TLS checks, endpoint probing, CORS testing
• dependency_auditor.py (777 lines) — Wraps npm audit and pip-audit with unified reporting
• code_security_scanner.py (780 lines) — Static analysis combining bandit + regex patterns for secrets, SQLi, command injection
• 3 real reference docs (OWASP Top 10, Security Headers, Remediation Playbook)
• Setup script for automated environment configuration
• AV-safe README that describes capabilities without any literal payloads

Verified AV-safe:

• grep -r '<?php' plugins/security/penetration-tester/ returns zero matches
• No <script> tags, no encoded payloads, no webshell signatures anywhere in the plugin
• All example output uses descriptions and redacted placeholders, never actual exploit code

Sorry about the scare — this should be completely resolved now.

[jeremylongshore]

Hey @duskfallcrew — thanks for reporting this! Your bug report directly led to a complete v2.0.0 rebuild of the plugin. The old version was honestly boilerplate stubs pretending to be real tools, and the PHP payloads in the README had no business being there.

You're now listed as a contributor in the plugin README. Appreciate you taking the time to file this even while dealing with the Windows Defender panic — totally understandable frustration. Should be smooth sailing now.