plugin-auditor

# Plugin Auditor ## Purpose Automatically audits Claude Code plugins for security vulnerabilities, best practice violations, CLAUDE.md compliance, and quality standards - optimized for claude-code-plugins repository requirements. ## Trigger Keywords - "audit plugin" - "security review" or "security audit" - "best practices check" - "plugin quality" - "compliance check" - "plugin security" ## Audit Categories ### 1. Security Audit **Critical Checks:** - ❌ No hardcoded secrets (passwords, API keys, tokens) - ❌ No AWS keys (AKIA...) - ❌ No private keys (BEGIN PRIVATE KEY) - ❌ No dangerous commands (rm -rf /, eval(), exec()) - ❌ No command injection vectors - ❌ No suspicious URLs (IP addresses, non-HTTPS) - ❌ No obfuscated code (base64 decode, hex encoding) **Security Patterns:** ```bash # Check for hardcoded secrets grep -r "password\s*=\s*['\"]" --exclude-dir=node_modules grep -r "api_key\s*=\s*['\"]" --exclude-dir=node_modules grep -r "secret\s*=\s*['\"]" --exclude-dir=node_modules # Check for AWS keys grep -r "AKIA[0-9A-Z]{16}" --exclude=README.md # Check for private keys grep -r "BEGIN.*PRIVATE KEY" --exclude=README.md # Check for dangerous patterns grep -r "rm -rf /" | grep -v "/var/" | grep -v "/tmp/" grep -r "eval\s*\(" --exclude=README.md ``` ### 2. Best Practices Audit **Plugin Structure:** - ✅ Proper directory hierarchy - ✅ Required files present - ✅ Semantic versioning (x.y.z) - ✅ Clear, concise descriptions - ✅ Proper LICENSE file (MIT/Apache-2.0) - ✅ Comp...