What problem does it solve? Claude Code plugins can accidentally ship with leaked API keys, hardcoded paths, injectable hook commands, or sensitive credential files. This Skill performs a six-category static security audit on a plugin directory and produces a severity-classified report with specific remediation for every finding. ## Core Features & Use Cases - Secret Detection: Scans all files for API keys (sk-, AKIA, ghp_*), private keys, passwords, and .env files, classifying matches as CRITICAL. - Hook & Script Analysis: Inspects hook commands for eval usage, unquoted variables, backtick substitution, and external URLs that could exfiltrate data. - Path & File Safety: Flags hardcoded absolute paths, path traversal patterns, and sensitive files like .pem, .key, or credentials.json. - Use Case: Before publishing a plugin to a marketplace, run the audit to catch a leaked OpenAI key in hooks.json and an unvalidated curl download in a setup script, then fix them using the provided remediation advice. ## Quick Start Run a security audit on the plugin at ./my-plugin and report all findings with severity levels and remediation steps.
