# Claude Plugin Marketplace Security Scanning: Automated Multi-Layer Review Before Approval

> Discover how the Claude Plugin Marketplace ensures security with automated multi-layer review. Learn about static analysis and AI policy checks before plugin approval.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: security-best-practices
- Published: 2026-09-12

---

**The Claude Plugin Marketplace validates every plugin submission through an automated, multi-step security scanning pipeline that combines deterministic static analysis with AI-driven policy review before any plugin is merged or listed.**

The `anthropics/claude-plugins-community` repository uses a defense-in-depth approach to **security scanning** that protects users from malicious or unsafe plugins. Before any plugin appears in the marketplace, it must pass the `scan-plugins` GitHub Action—a continuous integration workflow that enforces supply chain integrity and policy compliance. This automated pipeline ensures that every external tool listed in the `.claude-plugin/` directory meets Anthropic's security standards without requiring manual code review for every submission.

## The Four Layers of Automated Security Scanning

### 1. Static Pin Check for Supply Chain Integrity

Before any AI analysis begins, the action runs [`.github/actions/scan-plugins/scripts/static-pin-check.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/scripts/static-pin-check.sh) to perform deterministic static analysis. This script examines every MCP server declared in [`plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/plugin.json) or [`.mcp.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.mcp.json) files to ensure commands use exact commit SHAs rather than floating version specifiers like `@latest` or semantic version ranges. Because unpinned dependencies could pull malicious code at runtime, this check always emits warnings and can be configured to fail the build via `fail-on-unpinned-autoexec: true`, as documented in lines 18-34 of the action's [`README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/README.md).

### 2. Claude-Based Policy and Safety Analysis

The core security scanning logic invokes the Claude CLI using `claude -p` with the policy prompt located at [`.github/actions/scan-plugins/policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/policy/prompt.md). This automated review evaluates the plugin against Anthropic's Software Directory and Acceptable Use policies, flagging security-relevant findings such as unauthorized network calls, software installation attempts, or unsafe code patterns. The model returns a pass/fail verdict that the action parses into GitHub workflow annotations using `::warning` or `::error` commands when `fail-on-findings` is enabled.

### 3. Isolated Sandbox Environment

To prevent subversion during the review process, the scanning pipeline clones the plugin repository at the specific pinned SHA into a temporary directory. The analysis runs with **read-only file tools only** and restricts outbound network connections to an explicit allowlist containing `github.com`, `gitlab.com`, and `bitbucket.org`. This sandboxing, detailed in lines 70-79 of the scan-plugins documentation, ensures that malicious plugins cannot modify the scanning environment or exfiltrate data during the security review.

### 4. Configurable Enforcement Gates

Repository maintainers can tighten security scanning thresholds through action inputs defined in the workflow schema. Setting `fail-on-findings: true` causes the CI job to fail if the Claude policy scan detects any violations, while `fail-on-unpinned-autoexec: true` blocks merges containing floating version specifiers. These flags transform the pipeline from advisory warnings into mandatory security gates that prevent unsafe plugins from reaching the marketplace.

## Implementing the Security Scan in Your Workflow

The `scan-plugins` action triggers automatically on pull requests that modify the `.claude-plugin/**` directory. Below is a complete workflow configuration that implements the marketplace's security scanning requirements:

```yaml

# .github/workflows/scan-plugins.yml

name: Scan Plugins
on:
  pull_request:
    paths:
      - '.claude-plugin/**'

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # for optional Workload Identity Federation

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@<PINNED-SHA>
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          # Uncomment to block merges on any finding

          # fail-on-findings: "true"

```

For local development or pre-commit validation, you can run the static pin check directly without invoking the full AI scan:

```bash

# Verify version pinning without triggering the full AI scan

./.github/actions/scan-plugins/scripts/static-pin-check.sh plugins/example-plugin

# → prints warnings for any floating version specifiers

```

## Summary

- The marketplace uses a **multi-layer security scanning** approach combining static analysis and AI policy review, as stated in the root [`README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/README.md).
- **Static pin checks** in [`.github/actions/scan-plugins/scripts/static-pin-check.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/scripts/static-pin-check.sh) enforce deterministic, reproducible builds by rejecting floating version specifiers.
- **Claude-based policy analysis** uses [`policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/policy/prompt.md) and the `claude -p` CLI to evaluate security risks and policy violations against Anthropic's standards.
- **Sandboxed execution** clones plugins at pinned SHAs with read-only tools and network restrictions to prevent scan tampering.
- **Configurable enforcement** via `fail-on-findings` and `fail-on-unpinned-autoexec` inputs allows maintainers to block unsafe plugins automatically before they reach users.

## Frequently Asked Questions

### What triggers the security scan in the Claude Plugin Marketplace?

The `scan-plugins` GitHub Action runs automatically on every pull request that touches files within the `.claude-plugin/**` directory. This path-based trigger ensures that any new plugin submission or modification to existing plugins undergoes mandatory security validation before merge, as implemented in the repository's CI configuration.

### How does the static pin check prevent supply chain attacks?

The check implemented in [`.github/actions/scan-plugins/scripts/static-pin-check.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/scripts/static-pin-check.sh) validates that all MCP server commands reference exact commit SHAs rather than mutable tags like `@latest` or version ranges. This prevents attackers from compromising the supply chain by publishing malicious updates to unpinned dependencies after the plugin's initial approval, ensuring the reviewed code matches the executed code.

### Can the security scanning pipeline block plugins from being listed?

Yes. When repository administrators configure `fail-on-findings: true` or `fail-on-unpinned-autoexec: true` in the workflow inputs, the CI job will fail and prevent PRs from merging. According to [`README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/README.md) line 9, only plugins that have **passed automated security scanning** are eligible for listing in the marketplace, making these enforcement flags critical gatekeepers.

### What policies does the Claude scan evaluate against?

The AI policy scan uses the minimal prompt defined in [`.github/actions/scan-plugins/policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/policy/prompt.md) to evaluate plugins against Anthropic's Software Directory policies and Acceptable Use policies. It specifically hunts for security-relevant patterns including unauthorized network calls, attempts to install additional software, and other unsafe code execution patterns that could harm end users.