From afd45926316ec99a4ef2548f2c34e48c7b80816e Mon Sep 17 00:00:00 2001
From: _JONSNOW_ <marwankhodair1@gmail.com>
Date: Thu, 23 Jul 2026 00:45:04 +0300
Subject: [PATCH 1/3] security test: add bbp-poc plugin entry for Markdown
 injection PoC

---
 plugins/external.json | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/plugins/external.json b/plugins/external.json
index e8c8e3447..bc4265334 100644
--- a/plugins/external.json
+++ b/plugins/external.json
@@ -868,5 +868,26 @@
       "repo": "microsoft/win-dev-skills",
       "path": "plugins/winui"
     }
+  },
+  {
+    "name": "[BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot](https://github.com/marwankhodair/bbp-test-01) **SECURITY RESEARCH**",
+    "description": "Security research test for GitHub Bug Bounty Program. Demonstrates unescaped plugin.name injected into automated PR comment.",
+    "version": "1.0.0",
+    "author": {
+      "name": "marwankhodair",
+      "url": "https://github.com/marwankhodair"
+    },
+    "repository": "https://github.com/marwankhodair/bbp-test-01",
+    "license": "MIT",
+    "keywords": [
+      "security-research",
+      "bug-bounty"
+    ],
+    "source": {
+      "source": "github",
+      "repo": "marwankhodair/bbp-test-01",
+      "ref": "main",
+      "sha": "6dba280304fcba849cf9bf4e285af6a13489686e"
+    }
   }
 ]

From 9cb204dfe5321795cd8a6c6f5ff90edd703adc18 Mon Sep 17 00:00:00 2001
From: _JONSNOW_ <marwankhodair1@gmail.com>
Date: Thu, 23 Jul 2026 03:12:09 +0300
Subject: [PATCH 2/3] test: update plugin entry for quality gate table
 injection test

---
 plugins/external.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/external.json b/plugins/external.json
index bc4265334..2cfe92a5d 100644
--- a/plugins/external.json
+++ b/plugins/external.json
@@ -870,7 +870,7 @@
     }
   },
   {
-    "name": "[BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot](https://github.com/marwankhodair/bbp-test-01) **SECURITY RESEARCH**",
+    "name": "bbp-test-plugin | ✅ | ✅ | ✅ | ✅ | ✅ |",
     "description": "Security research test for GitHub Bug Bounty Program. Demonstrates unescaped plugin.name injected into automated PR comment.",
     "version": "1.0.0",
     "author": {
@@ -890,4 +890,4 @@
       "sha": "6dba280304fcba849cf9bf4e285af6a13489686e"
     }
   }
-]
+]
\ No newline at end of file

From a655d684f85679c18c03d23a1096be022bd8f372 Mon Sep 17 00:00:00 2001
From: _JONSNOW_ <marwankhodair1@gmail.com>
Date: Thu, 23 Jul 2026 03:58:26 +0300
Subject: [PATCH 3/3] test: use valid plugin name for install smoke gate test

---
 plugins/external.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/external.json b/plugins/external.json
index 2cfe92a5d..3b54ff0a1 100644
--- a/plugins/external.json
+++ b/plugins/external.json
@@ -870,7 +870,7 @@
     }
   },
   {
-    "name": "bbp-test-plugin | ✅ | ✅ | ✅ | ✅ | ✅ |",
+    "name": "bbp-rce-probe",
     "description": "Security research test for GitHub Bug Bounty Program. Demonstrates unescaped plugin.name injected into automated PR comment.",
     "version": "1.0.0",
     "author": {