Advanced security scanner for Claude Code plugins with 91 specialized pattern agents. Detects vulnerabilities, code obfuscation, and security anti-patterns using MITRE ATT&CK/ATLAS frameworks.
Advanced security scanner for Claude Code plugins with 91 specialized pattern agents. Detects vulnerabilities, code obfuscation, and security anti-patterns using MITRE ATT&CK/ATLAS frameworks.
/plugin marketplace add diegocconsolini/ClaudeSkillCollection/plugin install plugin-security-checker@security-compliance-marketplaceinheritA comprehensive security analysis tool for Claude Code plugins. Performs static code analysis to detect dangerous functions, code obfuscation, hardcoded credentials, and security anti-patterns.
This skill scans Claude Code plugins for security issues before installation. It provides preliminary security checks through static analysis, detecting common vulnerabilities and suspicious patterns.
IMPORTANT: This is a SUPPORTING TOOL for preliminary checks only. It does NOT guarantee plugin safety. Always review source code manually before installing plugins.
✓ Dangerous Function Detection
✓ Code Obfuscation Detection
✓ Credential Scanning
✓ Schema Validation
✓ Permission Analysis
✓ Dependency Analysis
✗ Guarantee plugin safety or security ✗ Detect all possible vulnerabilities ✗ Replace manual security code review ✗ Provide legal or compliance advice ✗ Detect zero-day vulnerabilities ✗ Analyze runtime behavior ✗ Verify external MCP server safety
Use this agent when:
# Basic scan
python3 scripts/scan_plugin.py /path/to/plugin
# Scan with JSON output
python3 scripts/scan_plugin.py /path/to/plugin --output scan_results.json --format json
# Scan with custom references path
python3 scripts/scan_plugin.py /path/to/plugin --references /path/to/references
from intelligent_orchestrator import IntelligentOrchestrator
# Initialize with all 91 agents
orchestrator = IntelligentOrchestrator(
patterns_file="references/dangerous_functions_expanded.json",
max_memory_mb=500,
enable_adaptive_routing=True
)
# Scan file with consensus voting
code = open("plugin.py").read()
detections = orchestrator.scan_file("plugin.py", code)
# Review consensus detections
for det in detections:
print(f"Line {det.line_number}: {det.severity}")
print(f" Confidence: {det.confidence:.0%}")
print(f" Voting agents: {det.vote_count}")
print(f" ATT&CK: {det.primary_attack_id}")
# Export findings to ATLAS format
orchestrator.export_findings("findings.json")
# Generate Markdown report
python3 scripts/generate_report.py scan_results.json --format markdown --output report.md
# Generate HTML report
python3 scripts/generate_report.py scan_results.json --format html --output report.html
# Scan multiple plugins from the collection
bash scripts/test_scanner.sh
# Scan ALL plugins from 15 marketplace repositories
bash scripts/scan_all_marketplace_plugins.sh
python3 scripts/scan_plugin.py /path/to/plugin --output scan.json --format json
python3 scripts/generate_report.py scan.json --format markdown --output report.md
The scanner uses curated reference databases:
Comprehensive Marketplace Scan:
Security Results:
Technical Performance:
PluginScanner
├── IntelligentOrchestrator (consensus voting)
├── AccuracyCache (shared learning)
├── 91 Specialized Pattern Agents
│ ├── CRITICAL (17): eval, exec, compile, rmtree, setuid
│ ├── HIGH (39): os.system, subprocess.*, socket.connect
│ ├── MEDIUM (23): chr obfuscation, debugger detection
│ └── LOW (2): tempfile.mktemp, input
├── Schema Validator (plugin.json)
├── Python AST Analyzer (ast.NodeVisitor)
├── JavaScript Parser (Babel/manual)
├── Dependency Analyzer
├── Permission Checker
└── Report Generator
AST Analysis:
Consensus Voting:
Pattern Matching:
Adaptive Learning:
🔒 Users are ultimately responsible for plugins they install 📖 ALWAYS review plugin source code manually before installation 🛡️ ONLY install plugins from trusted sources 🔍 VERIFY the plugin author's identity and reputation 💻 RUN untrusted plugins in sandboxed environments only ⚠️ USE this tool at own risk
This tool is provided "AS IS" without warranty of any kind, express or implied. The authors assume no liability for damages resulting from the use of this tool or from installing plugins scanned by this tool.
Found a vulnerability pattern we're missing? Have suggestions for improving detection? Contributions are welcome!
Plugin Security Checker v3.2.0
Remember: This is a preliminary security check tool. It helps identify common issues but does not replace thorough manual code review and security auditing.
Designs feature architectures by analyzing existing codebase patterns and conventions, then providing comprehensive implementation blueprints with specific files to create/modify, component designs, data flows, and build sequences