zhanj/claude-plugins-official
1
0
Fork 0
mirror of https://github.com/anthropics/claude-plugins-official.git synced 2026-05-21 22:42:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Wire scan-plugins to the detailed policy prompt

Browse Source 
Adds .github/policy/prompt.md and schema.json (the full security
review rubric — malicious code, privacy, deception, safety
circumvention, exfiltration; plus network-call and software-install
flags) and points scan-plugins at it via the policy-prompt input.

With ANTHROPIC_API_KEY now configured on the repo, scan-plugins runs
the actual policy review on changed external entries instead of
no-op'ing.
This commit is contained in:
tobin
2026-05-07 19:07:08 +00:00
parent 040af8dbf6
commit a3e148345f
3 changed files with 66 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.github/workflows/scan-plugins.yml vendored
View File

@@ -16,9 +16,9 @@ jobs:
with:
fetch-depth: 0
# Non-blocking by default. Graceful no-op if ANTHROPIC_API_KEY is not
# configured on the repo. To enforce, set fail-on-findings: "true".
# Non-blocking by default. To enforce, set fail-on-findings: "true".
- uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@f846a0bcb0e721b1f93d60e8b73e91dafc4a1e87
with:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
policy-prompt: .github/policy/prompt.md
claude-cli-version: latest