Monitored Credential Sources for Security Scanning in Claude Plugins Community

The scan-plugins GitHub Action monitors seven specific credential sources—including OS keychains, AWS credential files, SSH keys, Claude-specific vaults, browser stores, environment variables, and non-Anthropic endpoints—to prevent credential exfiltration in plugin submissions.

The anthropics/claude-plugins-community repository employs automated security scanning to ensure community plugins do not access or transmit sensitive credentials. The security policy is enforced through a Claude-based analysis that checks code against predefined credential source patterns defined in the policy prompt. Understanding these monitored sources helps developers write compliant plugins that pass the mandatory validate-plugins.yml workflow.

The Seven Credential Sources Monitored

The security policy explicitly defines seven categories of credential sources that trigger violations when accessed. These definitions reside in .github/actions/scan-plugins/policy/prompt.md between lines 26 and 34.

OS Credential Stores

Operating system native keychains represent the first line of defense for user secrets. The policy monitors attempts to access:

• macOS Keychain via security commands or Keychain Services APIs
• Windows Credential Manager through CredUI or vault APIs
• Linux Secret Service via secret-tool or libsecret bindings

Any attempt to read passwords, tokens, or certificates from these encrypted stores results in an immediate policy violation.

AWS Credential Files

The scanner watches for access to ~/.aws/credentials, the default location for AWS SDK configuration files containing access keys and secret keys. Hardcoded paths or dynamic resolution of this file path trigger blocking errors.

Private SSH Keys

SSH private keys stored in ~/.ssh/ represent high-value targets. The policy specifically monitors:

• ~/.ssh/id_* (all identity files)
• ~/.ssh/identity
• Any files within the .ssh directory containing private key material

Claude-Specific Vault

Plugins attempting to read from ~/.claude/.credentials—the Claude-specific credential vault used by many plugins—are flagged immediately. This protects the local credential cache from unauthorized access by third-party plugins.

Browser Cookie and Login Stores

Access to browser authentication data including Chrome, Firefox, or Safari cookie databases and login session stores constitutes a violation. This prevents plugins from hijacking existing web sessions.

Environment Variables

References to process.env.* or equivalent environment access patterns generate non-blocking warnings. While not strictly blocked, these accesses are logged as potential credential exfiltration vectors since API keys and tokens are frequently passed via environment configuration.

Non-Anthropic Endpoints

The policy treats any external service endpoint not owned by Anthropic as a potential exfiltration risk when combined with credential access. Plugins transmitting data to unauthorized third-party endpoints trigger credential-exfiltration violations.

How the Security Policy Enforces These Checks

The enforcement mechanism relies on three core components within the .github/actions/scan-plugins/ directory.

The policy/prompt.md file contains the static policy definitions including the credential source watchlist cited above. When the validate-plugins.yml workflow triggers on pull requests, it invokes the scan.sh script which runs a Claude-based analysis against the policy prompt.

The action.yml file in the same directory declares the action's inputs and authentication handling, while scan.sh implements the actual violation detection logic. Violations are categorized as either blocking errors (for direct credential store access) or non-blocking warnings (for environment variable reads).

Code Examples That Trigger Violations

The following TypeScript patterns demonstrate common violations detected during the scanning process.

Reading AWS Credentials (Blocking Error)

import * as fs from 'fs';

// ❌ Violates ~/.aws/credentials monitoring
const awsCreds = fs.readFileSync(
  process.env.HOME + '/.aws/credentials', 
  'utf8'
);

This code results in a fail-fast error: "Credential source /home/…/.aws/credentials accessed".

Accessing Environment Variables (Warning)

// ⚠️ Generates non-blocking warning
const apiKey = process.env.GITHUB_TOKEN;

The action logs this via ::warning workflow commands. The plugin may still merge, but the warning requires resolution.

macOS Keychain Access (Critical Violation)

import { execSync } from 'child_process';

// ❌ Critical credential exfiltration violation
const secret = execSync(
  'security find-generic-password -s my-service -w'
).toString();

This triggers an immediate scan abort and prevents plugin approval.

Summary

• The scan-plugins action monitors seven distinct credential source categories defined in policy/prompt.md lines 26-34.
• OS keychains, AWS credentials, SSH keys, Claude vaults, browser stores, environment variables, and non-Anthropic endpoints constitute the complete watchlist.
• Violations are enforced by scan.sh and categorized as blocking errors or non-blocking warnings depending on severity.
• Direct file system access to credential stores triggers immediate failures, while environment variable usage generates warnings.
• All checks run automatically via the validate-plugins.yml workflow on every pull request.

Frequently Asked Questions

What happens if my plugin accidentally accesses a monitored credential source?

The scan-plugins action will flag the violation in the GitHub Actions log. Blocking errors (like accessing ~/.aws/credentials or OS keychains) prevent merge approval, while non-blocking warnings (like reading process.env variables) allow merging but require acknowledgment. You must refactor the code to use secure parameter passing or Anthropic-approved authentication methods.

Are all environment variable reads blocked by the scan-plugins action?

No, environment variable access generates non-blocking warnings rather than hard failures. The policy recognizes that process.env.* is essential for configuration, but flags these accesses because they are common exfiltration vectors for API keys. You should minimize environment variable reads and never transmit these values to non-Anthropic endpoints.

How can I securely handle credentials in Claude plugins without triggering violations?

Design plugins to receive credentials through Anthropic-managed authentication flows rather than reading from local stores. Never access ~/.claude/.credentials, SSH keys, or browser stores directly. If your plugin requires API keys, instruct users to provide them through the Claude desktop application's secure configuration interface rather than file system reads.

Where is the credential source policy defined in the repository?

The complete credential source watchlist is defined in .github/actions/scan-plugins/policy/prompt.md, specifically lines 26-34. The enforcement logic resides in scan.sh, with workflow orchestration handled by .github/workflows/validate-plugins.yml. Plugin developers should review the policy prompt file before submitting external plugins.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}