skills.rest
jadecli
jadecliOFFICIAL
Explore all skills by this author →
GitHub

plugin-review

Identify security and safety flaws in generated knowledge-work plugins.

1|1|Updated Mar 27, 2026
Search Tags:#security#validation#compliance#static-analysis#scanning#policies#plugin-review
One-click install
npx skills add https://github.com/jadecli/researchers --skill plugin-review-jadecli
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: plugin-review
Source: https://github.com/jadecli/researchers/tree/main/claude-code-security-review/.claude/skills/plugin-review
Command: npx skills add https://github.com/jadecli/researchers --skill plugin-review-jadecli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill performs a structured security review of generated knowledge-work plugins, helping teams identify risks before deployment.

Core Features & Use Cases

  • Schema and policy checks: validates plugin.json, hooks.json, and .mcp.json for compliance and safety.
  • Code scanning guidance: outlines patterns to detect unsafe code and credential exposure in plugin scripts.
  • Use Case: Use it during plugin generation cycles to ensure artifacts meet security requirements before release.

Quick Start

Run the scanner on a plugin directory to perform an automated security review.

Frequently Asked Questions about plugin-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan generated plugins for security flaws and unsafe patterns?▼

Scanning generated plugins for security flaws involves validating the plugin.json schema and checking hooks and scripts for unsafe patterns. This process identifies credential handling issues and data flow risks before deployment.

What is static analysis for plugin manifests and hook configurations?▼

Static analysis for plugin manifests reviews configuration files like plugin.json, hooks.json, and .mcp.json for compliance. It validates schemas and detects unsafe code patterns to ensure artifacts meet security requirements.

How do I validate plugin.json schema and check for compliance issues?▼

Validating plugin.json schema requires checking the manifest against established policies and safety rules. This compliance check flags credential exposure and data flow vulnerabilities within hooks and configurations.

Can I use automated security review during plugin generation pipelines?▼

Automated security review can be applied directly during plugin generation pipelines. Running a scanner on the plugin directory performs artifact reviews and compliance checks before release.

What's the best way to detect credential exposure in generated plugin scripts?▼

Detecting credential exposure in plugin scripts requires code scanning guidance to identify unsafe patterns. Applying static analysis to hooks and configurations flags sensitive data flow issues across the plugin artifacts.

Why does my plugin review flag data flow issues in hooks and configurations?▼

Plugin reviews flag data flow issues when static analysis detects unsafe patterns in hooks and scripts. This safety mechanism highlights potential credential handling risks and schema violations in configurations.

Related Skills

Explore More Software Engineering Skills→
mikeparcewskimikeparcewski
8

plugin-json-schema

Validate Claude Code plugin.json manifests for required fields and auto-discovery.

Community
Advanced
dennisonbertramdennisonbertram
1

trivy-scan

Scan container images, filesystems, and repositories for vulnerabilities with Trivy.

Community
Advanced
TECHKNOWMAD-LABSTECHKNOWMAD-LABS

security-audit

Scan code repositories for vulnerabilities and leaked secrets using static analysis tools.

Official
Advanced
icartshicartsh
4

code-analyze

Analyze .NET solutions for code quality, security, and dependency issues.

Community
Advanced