highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl "https://api.tailscale.com/api/v2/tailnet/$TAILSCALE_TAILNET/devices" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
mediumsecurityCLAUDE_FIELD_MISSING_VERSION
The Claude manifest requires a non-empty "version" string.
Add "version" to the Claude manifest.
mediummanifest-validationPLUGIN_JSON_MISSING_VERSION
The manifest does not define a valid string for "version".
Add a non-empty string value for "version" in plugin.json.
lowsecuritySECURITY_MD_MISSINGReported 2 times
Plugins should publish a SECURITY.md file for responsible disclosure and support guidance.
Add a SECURITY.md file with reporting guidance and supported versions.
lowsecurityLICENSE_MISSINGReported 2 times
Plugins should ship a LICENSE file so consumers can review usage rights.
Add a LICENSE file that matches the manifest license metadata.
lowmanifest-validationPLUGIN_JSON_BAD_SEMVER
The version "" does not match the documented semver format.
Use a version like 1.2.3 in plugin.json.
lowbest-practicesREADME_MISSING
Plugins should document installation, usage, and security expectations in README.md.
Add a README.md that explains setup, usage, and operational constraints.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL
The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.
Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL
The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.
Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON
The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.
Update "composerIcon" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO
The interface field "logo" must use HTTPS or point to a safe in-repo asset.
Update "logo" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS
The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.
Update "screenshots" to use HTTPS or an existing relative asset path.
infobest-practicesCODEXIGNORE_MISSING
A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.
Add a .codexignore file with generated assets, local state, and secret paths.