[External Plugin]: security-test-plugin

[blooddiamondz]

Plugin name

security-test-plugin

Short description

Security research plugin for testing Copilot plugin intake quality gates and workflow security.

GitHub repository

blooddiamondz/copilot-security-test-plugin

Plugin path inside the repository

No response

Ref to review

No response

Commit SHA to review

b347dee4eca962c8f9ded4a4695d098872202eea

Version

1.0.0

License identifier

MIT

Author name

blooddiamondz

Author URL

https://github.com/blooddiamondz

Homepage URL

No response

Keywords

security-test

Additional notes for reviewers

Security research — testing npm lifecycle script execution in copilot plugin install.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

⚠️ External plugin intake requires submitter fixes

This submission passed metadata validation, but quality gates found issues that must be fixed before it can move to maintainer review. Update the issue details or source plugin and then comment /rerun-intake.

• Plugin: security-test-plugin

• Repository: https://github.com/blooddiamondz/copilot-security-test-plugin

• SHA: b347dee4eca962c8f9ded4a4695d098872202eea

Quality gate summary

Gate	Status
vally lint	fail
install smoke test	pass
version match	pass
canvas structure	not_run

• vally lint: fail
• install smoke test: pass
• version match: pass
• canvas structure: not_run
• overall: fail

vally lint output

❌ security-test (2/3 checks passed, 1 failed)
    ✗ [spec-compliance] 1 of 1 skill(s) have spec violations.
        ✗ spec-compliance: Spec checks failed.
            ✗ Name "security-test" does not match directory name "test-skill".
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
    ✓ [orphan-files] No orphan files found across 1 skill(s).
        ✓ orphan-files: No references/ directory found — no orphans possible.

1 skill(s) linted, 1 failed

Install smoke test output

Install smoke test succeeded. Verified /tmp/external-plugin-quality-fAOIni/copilot-home/.copilot/installed-plugins/external-plugin-intake/security-test-plugin/.plugin/plugin.json.

Version match output

- b347dee4eca962c8f9ded4a4695d098872202eea: matched version "1.0.0" at ".plugin/plugin.json".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "security-test-plugin",
  "description": "Security research plugin for testing Copilot plugin intake quality gates and workflow security.",
  "version": "1.0.0",
  "author": {
    "name": "blooddiamondz",
    "url": "https://github.com/blooddiamondz"
  },
  "repository": "https://github.com/blooddiamondz/copilot-security-test-plugin",
  "license": "MIT",
  "keywords": [
    "security-test"
  ],
  "source": {
    "source": "github",
    "repo": "blooddiamondz/copilot-security-test-plugin",
    "sha": "b347dee4eca962c8f9ded4a4695d098872202eea"
  }
}

View workflow run