# Security Requirements for Community Plugins: A Complete Guide to the Claude Plugins Review Process

> Discover the security requirements for community plugins. Learn about Claude's three-layer review process for safe and secure plugin publication.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: best-practices
- Published: 2026-09-13

---

**The Claude Plugins Community enforces a strict three-layer security gate—automated vulnerability scanning, policy invariant checks (I1‑I9), and Claude-driven safety review—that every plugin must pass before publication to prevent credential exfiltration, unauthorized network calls, and malicious code execution.**

Community plugins submitted to the `anthropics/claude-plugins-community` repository must satisfy rigorous security requirements before they are listed in the public directory. These requirements are defined in the validation infrastructure and policy prompts found in `.github/actions/validate-plugins/` and [`.github/actions/scan-plugins/policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/policy/prompt.md), creating a defense-in-depth approach that combines automated static analysis with AI-driven behavioral auditing.

## The Three-Layer Security Gate

The security framework consists of three distinct validation phases that operate sequentially. According to the repository's documentation in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md), these layers ensure that every submission is analyzed for known vulnerabilities, schema compliance, and dangerous behavioral patterns before human approval.

### Layer 1: Automated Security Scanning

Every plugin submission triggers an automated scan that hunts for known vulnerabilities, unsafe dependencies, and disallowed patterns. As stated in the root [`README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/README.md), no human reviewer examines a plugin until it has "passed automated security scanning." This initial filter blocks obvious security risks before they enter the manual review queue.

### Layer 2: Policy Invariants (I1‑I9)

The validator enforces nine strict invariant checks—labeled I1 through I9—that govern required manifest fields, prohibited file-system actions, and restricted network behaviors. These invariants are "intentionally stricter than the canonical schema," serving as hard gates that fail the build if violated. The checks are implemented in the validation logic referenced in [`.github/actions/validate-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/validate-plugins/README.md).

### Layer 3: Claude-Based Policy and Safety Scan

The final layer employs a Claude-driven reviewer that executes the policy prompt defined in [`.github/actions/scan-plugins/policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/policy/prompt.md). This AI auditor examines the full plugin payload for dangerous behaviors including **cross-service credential exfiltration**, **unauthorized external network calls**, and **runtime software downloads** that bypass the declared manifest.

## Core Security Policies and Restrictions

The policy prompt and validation rules explicitly prohibit specific high-risk behaviors. Plugin developers must understand these constraints when authoring [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json) manifests and implementation code.

### Cross-Service Credential Exfiltration Prevention

Plugins must never read credentials belonging to one service and transmit them to a different endpoint. The policy prompt specifically flags code that routes `ANTHROPIC_AUTH_TOKEN` or similar sensitive tokens to non-Anthropic endpoints. This invariant prevents credential theft even if a plugin is compromised.

### Controlled External Network Access

Network calls are restricted to explicitly permitted endpoints declared in the manifest. The boolean field `may_make_external_network_calls` must be set to `true` only when essential to the plugin's function, and any allowed destinations must be listed in `allowed_endpoints`. The validator inspects all code paths to ensure no unauthorized outbound connections exist.

### Prohibition on Runtime Software Downloads

Plugins cannot install additional packages or download executables at runtime unless these dependencies are declared as build dependencies. The `may_download_additional_software` field in the manifest must be `false` for most submissions, ensuring the plugin operates within the constraints of its shipped files.

### Surface File Auditing

The validator inspects all files under the plugin’s surface area, including [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json), [`.mcp.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.mcp.json), and directories such as `skills/`, `agents/`, `commands/`, and `hooks/`, plus hidden directories like `.claude/`. Every file shipped in the repository is considered reachable and must pass static analysis checks for prohibited patterns such as `eval`, `exec`, or unsafe shell command construction.

## Implementing Security-Compliant Plugin Manifests

To satisfy the security requirements, developers must structure their [`plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/plugin.json) manifests with explicit security declarations. The manifest serves as a contract that the validator uses to enforce behavioral constraints.

### Safe Default Configuration

For plugins that operate without external dependencies, set both security flags to `false`:

```json
{
  "name": "example-hello-world",
  "description": "A tiny hello-world example plugin.",
  "version": "0.1.0",
  "author": "Your Name",
  "license": "MIT",
  "entrypoints": {
    "skills": [
      "skills/hello_world/SKILL.md"
    ]
  },
  "may_make_external_network_calls": false,
  "may_download_additional_software": false
}

```

Key compliance points:

- `may_make_external_network_calls` is **false** — the plugin does not reach out to the internet.
- `may_download_additional_software` is **false** — the plugin relies only on the files shipped in the repo.
- All code lives under `skills/` (the declared surface), so the validator can audit it completely.

### Opting-In to External Network Calls

If a plugin requires API access, explicitly declare the capability and whitelist endpoints:

```json
"may_make_external_network_calls": true,
"allowed_endpoints": ["https://api.openweathermap.org"]

```

The validator will then verify that the only network calls are directed to the listed endpoints. The CI workflow defined in [`.github/workflows/validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/validate-plugins.yml) automatically runs these validation checks on every pull request, rejecting submissions where the declared capabilities mismatch the detected code behavior.

## Summary

- The Claude Plugins Community implements a three-layer security gate (automated scanning, I1‑I9 invariants, and Claude-based review) for all community plugins.
- Foundational policy files located in `.github/actions/validate-plugins/` and [`.github/actions/scan-plugins/policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/policy/prompt.md) define the specific behavioral constraints.
- Plugins must declare network and download capabilities in [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json) using `may_make_external_network_calls` and `may_download_additional_software`.
- Cross-service credential exfiltration and runtime software installation are strictly prohibited unless explicitly authorized.
- All surface files, including hidden directories and skill definitions, undergo static analysis for dangerous patterns like `eval` or `exec`.

## Frequently Asked Questions

### What files are inspected during the security review?

The validator examines the complete surface area of the plugin, including [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json), [`.mcp.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.mcp.json), and all files within `skills/`, `agents/`, `commands/`, `hooks/`, and hidden directories such as `.claude/`. Any code shipped in the repository is considered reachable and must pass security checks.

### Can a community plugin make external API calls?

Yes, but only if the plugin manifest explicitly sets `may_make_external_network_calls` to `true` and lists specific endpoints in the `allowed_endpoints` array. The validator will reject any plugin that attempts network connections not declared in this manifest contract.

### What happens if a plugin fails the automated security scan?

If any layer of the security gate detects a violation—whether an I1‑I9 invariant failure, a prohibited pattern match, or a policy violation flagged by the Claude-based reviewer—the plugin is rejected from the directory. The contributor receives feedback on the specific failure and must remediate the issue before resubmission.

### Are plugins allowed to install additional Python packages at runtime?

No. The `may_download_additional_software` field must typically be set to `false`, prohibiting runtime installation of extra packages or downloaded executables. Plugins must rely only on dependencies declared in their build configuration and files shipped within the repository.