What specific security risks does the Plugin Auditor look for?

It scans for hardcoded API keys, AWS secrets, private keys, command injection vectors, and dangerous bash patterns like 'rm -rf /' or obfuscated code.

When should I run the Plugin Auditor?

You should trigger an audit whenever you mention 'audit plugin', 'security review', or 'best practices check' to verify your code before publishing or sharing.

Can the Plugin Auditor fix the issues it finds?

Yes, it features auto-fix capabilities for common issues such as missing script execute permissions, JSON/Markdown formatting, and version synchronization errors.

How does it verify marketplace compliance?

It checks the plugin against marketplace.extended.json requirements, validates the plugin.json schema, and ensures the versioning matches the marketplace catalog entry.

Plugin Auditor

Name: Plugin Auditor
Author: BbgnsurfTech

byBbgnsurfTech

•

安全与测试

Performs automated security audits and compliance checks for Claude Code plugins to ensure production-readiness and repository standards.

关于

The Plugin Auditor is a specialized skill designed to automate the rigorous review process for Claude Code plugins, ensuring they meet strict security, quality, and repository standards. It systematically scans for hardcoded secrets, dangerous command patterns, and directory structure violations while validating compliance with CLAUDE.md and marketplace requirements. By providing a detailed quality score and actionable remediation steps, this skill helps developers harden their plugins against vulnerabilities and streamline the path to official marketplace inclusion.

主要功能

Auto-fix capabilities for script permissions, formatting, and versioning issues
Marketplace compliance verification including JSON schema and version consistency
3 GitHub stars
Structural validation against CLAUDE.md and plugin directory standards
Automated security scanning for secrets, AWS keys, and dangerous command patterns
Detailed audit reporting with quality scores and categorized severity levels

使用场景

Automated quality assurance during development or before merging pull requests
Pre-publication security review for new Claude Code plugins before submission
Maintaining high code quality and repository standards across custom internal plugin suites

关于

主要功能

Auto-fix capabilities for script permissions, formatting, and versioning issues
Marketplace compliance verification including JSON schema and version consistency
3 GitHub stars
Structural validation against CLAUDE.md and plugin directory standards
Automated security scanning for secrets, AWS keys, and dangerous command patterns
Detailed audit reporting with quality scores and categorized severity levels

使用场景

Automated quality assurance during development or before merging pull requests
Pre-publication security review for new Claude Code plugins before submission
Maintaining high code quality and repository standards across custom internal plugin suites