Pull Request

September 11, 2026 · View on GitHub

📘 First time contributing? Read both:

CONTRIBUTING.md § Before You Submit — the contract and the workflow

Plugin & Skill Spec (v3.6.0 baseline; enforced schema 3.15.2 — see 000-docs/SCHEMA_CHANGELOG.md) — the authoritative spec the validator scores against (8-field frontmatter, 7 body sections, 100-point rubric, all source-cited)

The PR Pre-screen workflow sets an advisory prescreen-grade status on every run and posts a structured comment with the exact validator findings only when changes are needed (silent on PASS) — reading both up front saves a round-trip.

Type of Change

Description

Summary:

Motivation:

Related Issues:

Submission Standard (plugin & source submissions)

This PR links its submission issue (Closes #N / Refs #N) — submissions start as an issue using the plugin-submission template; a PR without one will be asked to file it
The required docs for my declared tier are included (docs/PRD.md at minimum — see the tier→docs matrix)
Validator run locally (python3 scripts/validate-skills-schema.py --marketplace --verbose <plugin-dir>)
For feat(sources) PRs: source vetted per the external-source vetting playbook
verified: / curated: flags in sources.yaml are honest (no verified: true without maintainer vetting; no silently hardened mirrors without curated: true)

Security

Related alerts: GHSA-/CVE-
Impact assessment: None / Low / Medium / High

Plugin Details (for plugin submissions/updates)

Plugin Name: Category: Version: Keywords:

Components Included:

Dependencies:

Checklist

For All PRs

I have read the CONTRIBUTING.md guidelines
"Allow edits by maintainers" is enabled (fork PRs) — we push small regen/bump fixes to your branch instead of round-tripping
My code follows the project's style and conventions
I have performed a self-review of my code
I have commented my code where necessary
My changes generate no new warnings or errors
Documentation has been updated (if applicable)
CodeQL passes; no new code scanning alerts
No high/critical Dependabot alerts introduced

For Plugin Submissions/Updates

For Marketplace Website Changes

Website builds successfully (cd marketplace && npm run build)
No broken links or missing assets
Mobile-responsive design verified
SEO metadata updated (if applicable)
Accessibility standards followed (WCAG 2.1)

For Documentation Changes

Spelling and grammar checked
Code examples tested and working
Links verified and not broken
Screenshots/diagrams updated (if applicable)
Version references updated

Testing Evidence

Test Environment:

OS:
Claude Code Version:
Python Version (if applicable):
Node Version (if applicable):

Test Commands Run:

# Example:
/plugin install my-plugin@test
/my-command --option value

Test Results:

Edge Cases Tested:

Works with minimal configuration
Handles errors gracefully
Works across different platforms (macOS, Linux, Windows)
Performance is acceptable for large inputs
Security considerations addressed

Breaking Changes

Yes (describe below)
No

If yes, describe:

Screenshots / Recordings (if applicable)

Performance Impact

No performance impact
Minor performance impact (negligible)
Moderate performance impact (describe below)
Significant performance impact (describe and justify below)

Security Considerations

Automated Security Scans

No hardcoded secrets (API keys, passwords, tokens)
No AWS keys, private keys, or credentials detected
No destructive commands (rm -rf /, data deletion)
No eval() or command injection risks
No suspicious curl/wget to IP addresses
No base64 obfuscation detected
All URLs use HTTPS (except localhost)
No URL shorteners (potential phishing)

Manual Security Review

Prompt Injection Protection: No hidden instructions that hijack Claude's behavior
Data Privacy: No data exfiltration to external servers (all network calls documented in README)
Permission Audit: Plugin requests minimal necessary permissions only
Clear Intent: README clearly explains what the plugin does
Input Validation: All user inputs validated before processing
Error Handling: No sensitive data in error messages
Dependencies: All npm dependencies reviewed (for MCP plugins)

Testing

Tested in isolated environment before submission
No unexpected side effects observed
Graceful error handling for edge cases
Works as documented in README

Rollback Plan

Additional Notes

Reviewer Checklist (for maintainers)

By submitting this PR, I confirm:

I have the right to submit this code under the project's license
I understand my contributions will be publicly available
I agree to the project's Code of Conduct