Claude
official Claude Code plugin directory
connecting…
Browse the advisory list ›
| skill | advisory |
|---|
truecopy
Own Your Stack · Sprayberry Labs
The skill supply chain,
scanned in the open.
Agents install tools from places you don’t control. truecopy poison-scans every skill & MCP server, pins the vetted bytes into a lockfile, and fails the build if anything drifts. Below is the scan itself — run weekly, published raw, nothing hidden.
// live scan board
Four ecosystems. One honest scoreboard.
Each card says exactly what it is. A live card refreshes from the public weekly scan; an audit card is a dated point-in-time run; a scheduled card is a watch we haven’t stood up yet — we don’t show a scan we didn’t run.
OpenClaw
ClawHub registry — the marketplace whose poisoning started the category
point-in-time audit
66,541skills scanned
0confirmed malicious
1full-registry sweep
A single deterministic sweep of the entire registry — not a live feed. Read the write-up: the marketplace that started the panic →
ChatGPTofficial Plugin directory — MCP apps & connectors
watch scheduled
OpenAI’s Plugin directory (formerly apps / connectors) is MCP-based — the same tool-schema surface truecopy scans. No scan has run yet; the watch goes live once truecopy introspects and poison-scans it. We won’t publish a directory size we can’t independently verify.
HermesNous Research Hermes Agent — community Skills Hub
watch scheduled
Hermes skills use the SKILL.md (agentskills.io) format truecopy already
reads, so it’s the next watch we’ll stand up. Its registries are community-maintained; we’ll
publish counts only from our own scan.
Source of truth: the public watch branch
— every number here is fetched live from
results.json.
Deterministic, offline, and it eats its own cooking.
- Scan. Each skill’s name, description, and tool schemas are checked for injection & exfiltration instructions — the OpenClaw class of poisoning.
- Pin. Vetted bytes are hashed into a
truecopy.lock(optionally signed). - Verify. On every run/CI, a pinned skill whose bytes changed is a silent update or a
supply-chain attack —
truecopy verifyexits non-zero before it loads. - Watch. A standing job re-scans the whole directory weekly and publishes the verdict
to the
watchbranch. This board reads that.
Advisory ≠ poisoned. An advisory is a cautionary heuristic flag (e.g. “references a sensitive path”) worth a human glance — not a detection of malice. Confirmed-poisoned is the count that matters, and across the directory it stays at zero.
Two commands to your own lockfile.
npm i -g @askalf/truecopy
truecopy add --claude --claude-plugins --sign # vet + pin every skill you can see
truecopy verify # CI: exit 1 on drift or poison