[BUG] Claude should not clone claude-plugins-official.git with SSH

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The latest version of Claude Code attempts to clone a GitHub repository, using SSH:

  git clone --depth 1 git@github.com:anthropics/claude-plugins-official.git
      /Users/stbenjam/.claude/plugins/marketplaces/claude-plugins-official

This causes a creepy prompt for my YubiKey pin every time Claude starts.

What Should Happen?

Clone over HTTPS instead, there's no reason to use SSH for a public repo.

StrictHostKeyChecking is also opening me up to a MITM attack, instead of using HTTPS would be using signed certificates

Error Messages/Logs

Using eslogger on my Mac, I see claude code executes this:


  git -c credential.helper= \
      -c "core.sshCommand=ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new" \
      clone --depth 1 \
      git@github.com:anthropics/claude-plugins-official.git \
      /Users/stbenjam/.claude/plugins/marketplaces/claude-plugins-official

Steps to Reproduce

Launch Claude Code, with SSH configured to use keys form a YubiKey, protected by a pin. It will prompt you every time.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.0.69

Claude Code Version

2.0.71

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

<img width="731" height="483" alt="Image" src="https://github.com/user-attachments/assets/1b0ed78e-dc3b-4e0a-b3a8-fe48e1f79e3a" />