diff --git a/plugins/external.json b/plugins/external.json
index e8c8e3447..3b54ff0a1 100644
--- a/plugins/external.json
+++ b/plugins/external.json
@@ -868,5 +868,26 @@
       "repo": "microsoft/win-dev-skills",
       "path": "plugins/winui"
     }
+  },
+  {
+    "name": "bbp-rce-probe",
+    "description": "Security research test for GitHub Bug Bounty Program. Demonstrates unescaped plugin.name injected into automated PR comment.",
+    "version": "1.0.0",
+    "author": {
+      "name": "marwankhodair",
+      "url": "https://github.com/marwankhodair"
+    },
+    "repository": "https://github.com/marwankhodair/bbp-test-01",
+    "license": "MIT",
+    "keywords": [
+      "security-research",
+      "bug-bounty"
+    ],
+    "source": {
+      "source": "github",
+      "repo": "marwankhodair/bbp-test-01",
+      "ref": "main",
+      "sha": "6dba280304fcba849cf9bf4e285af6a13489686e"
+    }
   }
-]
+]
\ No newline at end of file