# Monitored Credential Sources for Security Scanning in Claude Plugins Community

> Discover the seven monitored credential sources used for security scanning in Claude Plugins. Learn how the scan-plugins GitHub Action protects against credential exfiltration and secures your submissions.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: best-practices
- Published: 2026-08-29

---

**The `scan-plugins` GitHub Action monitors seven specific credential sources—including OS keychains, AWS credential files, SSH keys, Claude-specific vaults, browser stores, environment variables, and non-Anthropic endpoints—to prevent credential exfiltration in plugin submissions.**

The `anthropics/claude-plugins-community` repository employs automated security scanning to ensure community plugins do not access or transmit sensitive credentials. The security policy is enforced through a Claude-based analysis that checks code against predefined credential source patterns defined in the policy prompt. Understanding these monitored sources helps developers write compliant plugins that pass the mandatory [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow.

## The Seven Credential Sources Monitored

The security policy explicitly defines seven categories of credential sources that trigger violations when accessed. These definitions reside in [`.github/actions/scan-plugins/policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/policy/prompt.md) between lines 26 and 34.

### OS Credential Stores

**Operating system native keychains** represent the first line of defense for user secrets. The policy monitors attempts to access:

- **macOS Keychain** via `security` commands or Keychain Services APIs
- **Windows Credential Manager** through CredUI or vault APIs
- **Linux Secret Service** via `secret-tool` or libsecret bindings

Any attempt to read passwords, tokens, or certificates from these encrypted stores results in an immediate policy violation.

### AWS Credential Files

The scanner watches for access to **`~/.aws/credentials`**, the default location for AWS SDK configuration files containing access keys and secret keys. Hardcoded paths or dynamic resolution of this file path trigger blocking errors.

### Private SSH Keys

**SSH private keys** stored in `~/.ssh/` represent high-value targets. The policy specifically monitors:
- `~/.ssh/id_*` (all identity files)
- `~/.ssh/identity`
- Any files within the `.ssh` directory containing private key material

### Claude-Specific Vault

Plugins attempting to read from **`~/.claude/.credentials`**—the Claude-specific credential vault used by many plugins—are flagged immediately. This protects the local credential cache from unauthorized access by third-party plugins.

### Browser Cookie and Login Stores

Access to **browser authentication data** including Chrome, Firefox, or Safari cookie databases and login session stores constitutes a violation. This prevents plugins from hijacking existing web sessions.

### Environment Variables

References to **`process.env.*`** or equivalent environment access patterns generate non-blocking warnings. While not strictly blocked, these accesses are logged as potential credential exfiltration vectors since API keys and tokens are frequently passed via environment configuration.

### Non-Anthropic Endpoints

The policy treats **any external service endpoint not owned by Anthropic** as a potential exfiltration risk when combined with credential access. Plugins transmitting data to unauthorized third-party endpoints trigger credential-exfiltration violations.

## How the Security Policy Enforces These Checks

The enforcement mechanism relies on three core components within the `.github/actions/scan-plugins/` directory.

The [`policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/policy/prompt.md) file contains the static policy definitions including the credential source watchlist cited above. When the [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow triggers on pull requests, it invokes the [`scan.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/scan.sh) script which runs a Claude-based analysis against the policy prompt.

The [`action.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/action.yml) file in the same directory declares the action's inputs and authentication handling, while [`scan.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/scan.sh) implements the actual violation detection logic. Violations are categorized as either **blocking errors** (for direct credential store access) or **non-blocking warnings** (for environment variable reads).

## Code Examples That Trigger Violations

The following TypeScript patterns demonstrate common violations detected during the scanning process.

### Reading AWS Credentials (Blocking Error)

```typescript
import * as fs from 'fs';

// ❌ Violates ~/.aws/credentials monitoring
const awsCreds = fs.readFileSync(
  process.env.HOME + '/.aws/credentials', 
  'utf8'
);

```

This code results in a fail-fast error: **"Credential source /home/…/.aws/credentials accessed"**.

### Accessing Environment Variables (Warning)

```typescript
// ⚠️ Generates non-blocking warning
const apiKey = process.env.GITHUB_TOKEN;

```

The action logs this via `::warning` workflow commands. The plugin may still merge, but the warning requires resolution.

### macOS Keychain Access (Critical Violation)

```typescript
import { execSync } from 'child_process';

// ❌ Critical credential exfiltration violation
const secret = execSync(
  'security find-generic-password -s my-service -w'
).toString();

```

This triggers an immediate scan abort and prevents plugin approval.

## Summary

- The `scan-plugins` action monitors **seven distinct credential source categories** defined in [`policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/policy/prompt.md) lines 26-34.
- **OS keychains, AWS credentials, SSH keys, Claude vaults, browser stores, environment variables, and non-Anthropic endpoints** constitute the complete watchlist.
- Violations are enforced by [`scan.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/scan.sh) and categorized as **blocking errors** or **non-blocking warnings** depending on severity.
- Direct file system access to credential stores triggers immediate failures, while environment variable usage generates warnings.
- All checks run automatically via the [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow on every pull request.

## Frequently Asked Questions

### What happens if my plugin accidentally accesses a monitored credential source?

The `scan-plugins` action will flag the violation in the GitHub Actions log. **Blocking errors** (like accessing `~/.aws/credentials` or OS keychains) prevent merge approval, while **non-blocking warnings** (like reading `process.env` variables) allow merging but require acknowledgment. You must refactor the code to use secure parameter passing or Anthropic-approved authentication methods.

### Are all environment variable reads blocked by the scan-plugins action?

No, environment variable access generates **non-blocking warnings** rather than hard failures. The policy recognizes that `process.env.*` is essential for configuration, but flags these accesses because they are common exfiltration vectors for API keys. You should minimize environment variable reads and never transmit these values to non-Anthropic endpoints.

### How can I securely handle credentials in Claude plugins without triggering violations?

Design plugins to receive credentials through **Anthropic-managed authentication flows** rather than reading from local stores. Never access `~/.claude/.credentials`, SSH keys, or browser stores directly. If your plugin requires API keys, instruct users to provide them through the Claude desktop application's secure configuration interface rather than file system reads.

### Where is the credential source policy defined in the repository?

The complete credential source watchlist is defined in **[`.github/actions/scan-plugins/policy/prompt.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/policy/prompt.md)**, specifically lines 26-34. The enforcement logic resides in **[`scan.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/scan.sh)**, with workflow orchestration handled by **[`.github/workflows/validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/validate-plugins.yml)**. Plugin developers should review the policy prompt file before submitting external plugins.