Security Requirements for Community Plugins: A Complete Guide to the Claude Plugins Review Process

The Claude Plugins Community enforces a strict three-layer security gate—automated vulnerability scanning, policy invariant checks (I1‑I9), and Claude-driven safety review—that every plugin must pass before publication to prevent credential exfiltration, unauthorized network calls, and malicious code execution.

Community plugins submitted to the anthropics/claude-plugins-community repository must satisfy rigorous security requirements before they are listed in the public directory. These requirements are defined in the validation infrastructure and policy prompts found in .github/actions/validate-plugins/ and .github/actions/scan-plugins/policy/prompt.md, creating a defense-in-depth approach that combines automated static analysis with AI-driven behavioral auditing.

The Three-Layer Security Gate

The security framework consists of three distinct validation phases that operate sequentially. According to the repository's documentation in .github/actions/validate-plugins/README.md, these layers ensure that every submission is analyzed for known vulnerabilities, schema compliance, and dangerous behavioral patterns before human approval.

Layer 1: Automated Security Scanning

Every plugin submission triggers an automated scan that hunts for known vulnerabilities, unsafe dependencies, and disallowed patterns. As stated in the root README.md, no human reviewer examines a plugin until it has "passed automated security scanning." This initial filter blocks obvious security risks before they enter the manual review queue.

Layer 2: Policy Invariants (I1‑I9)

The validator enforces nine strict invariant checks—labeled I1 through I9—that govern required manifest fields, prohibited file-system actions, and restricted network behaviors. These invariants are "intentionally stricter than the canonical schema," serving as hard gates that fail the build if violated. The checks are implemented in the validation logic referenced in .github/actions/validate-plugins/README.md.

Layer 3: Claude-Based Policy and Safety Scan

The final layer employs a Claude-driven reviewer that executes the policy prompt defined in .github/actions/scan-plugins/policy/prompt.md. This AI auditor examines the full plugin payload for dangerous behaviors including cross-service credential exfiltration, unauthorized external network calls, and runtime software downloads that bypass the declared manifest.

Core Security Policies and Restrictions

The policy prompt and validation rules explicitly prohibit specific high-risk behaviors. Plugin developers must understand these constraints when authoring .claude-plugin/plugin.json manifests and implementation code.

Cross-Service Credential Exfiltration Prevention

Plugins must never read credentials belonging to one service and transmit them to a different endpoint. The policy prompt specifically flags code that routes ANTHROPIC_AUTH_TOKEN or similar sensitive tokens to non-Anthropic endpoints. This invariant prevents credential theft even if a plugin is compromised.

Controlled External Network Access

Network calls are restricted to explicitly permitted endpoints declared in the manifest. The boolean field may_make_external_network_calls must be set to true only when essential to the plugin's function, and any allowed destinations must be listed in allowed_endpoints. The validator inspects all code paths to ensure no unauthorized outbound connections exist.

Prohibition on Runtime Software Downloads

Plugins cannot install additional packages or download executables at runtime unless these dependencies are declared as build dependencies. The may_download_additional_software field in the manifest must be false for most submissions, ensuring the plugin operates within the constraints of its shipped files.

Surface File Auditing

The validator inspects all files under the plugin’s surface area, including .claude-plugin/plugin.json, .mcp.json, and directories such as skills/, agents/, commands/, and hooks/, plus hidden directories like .claude/. Every file shipped in the repository is considered reachable and must pass static analysis checks for prohibited patterns such as eval, exec, or unsafe shell command construction.

Implementing Security-Compliant Plugin Manifests

To satisfy the security requirements, developers must structure their plugin.json manifests with explicit security declarations. The manifest serves as a contract that the validator uses to enforce behavioral constraints.

Safe Default Configuration

For plugins that operate without external dependencies, set both security flags to false:

{
  "name": "example-hello-world",
  "description": "A tiny hello-world example plugin.",
  "version": "0.1.0",
  "author": "Your Name",
  "license": "MIT",
  "entrypoints": {
    "skills": [
      "skills/hello_world/SKILL.md"
    ]
  },
  "may_make_external_network_calls": false,
  "may_download_additional_software": false
}

Key compliance points:

• may_make_external_network_calls is false — the plugin does not reach out to the internet.
• may_download_additional_software is false — the plugin relies only on the files shipped in the repo.
• All code lives under skills/ (the declared surface), so the validator can audit it completely.

Opting-In to External Network Calls

If a plugin requires API access, explicitly declare the capability and whitelist endpoints:

"may_make_external_network_calls": true,
"allowed_endpoints": ["https://api.openweathermap.org"]

The validator will then verify that the only network calls are directed to the listed endpoints. The CI workflow defined in .github/workflows/validate-plugins.yml automatically runs these validation checks on every pull request, rejecting submissions where the declared capabilities mismatch the detected code behavior.

Summary

• The Claude Plugins Community implements a three-layer security gate (automated scanning, I1‑I9 invariants, and Claude-based review) for all community plugins.
• Foundational policy files located in .github/actions/validate-plugins/ and .github/actions/scan-plugins/policy/prompt.md define the specific behavioral constraints.
• Plugins must declare network and download capabilities in .claude-plugin/plugin.json using may_make_external_network_calls and may_download_additional_software.
• Cross-service credential exfiltration and runtime software installation are strictly prohibited unless explicitly authorized.
• All surface files, including hidden directories and skill definitions, undergo static analysis for dangerous patterns like eval or exec.

Frequently Asked Questions

What files are inspected during the security review?

The validator examines the complete surface area of the plugin, including .claude-plugin/plugin.json, .mcp.json, and all files within skills/, agents/, commands/, hooks/, and hidden directories such as .claude/. Any code shipped in the repository is considered reachable and must pass security checks.

Can a community plugin make external API calls?

Yes, but only if the plugin manifest explicitly sets may_make_external_network_calls to true and lists specific endpoints in the allowed_endpoints array. The validator will reject any plugin that attempts network connections not declared in this manifest contract.

What happens if a plugin fails the automated security scan?

If any layer of the security gate detects a violation—whether an I1‑I9 invariant failure, a prohibited pattern match, or a policy violation flagged by the Claude-based reviewer—the plugin is rejected from the directory. The contributor receives feedback on the specific failure and must remediate the issue before resubmission.

Are plugins allowed to install additional Python packages at runtime?

No. The may_download_additional_software field must typically be set to false, prohibiting runtime installation of extra packages or downloaded executables. Plugins must rely only on dependencies declared in their build configuration and files shipped within the repository.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}