wbso-ai

Omarchy Plugin Security Skill — Security skill for Claude Code

Security community

Agent skill and field guide: the security pitfalls that block Omarchy plugins on the marketplace, from 5,000+ maintainer reviews.

How to install Omarchy Plugin Security Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open wbso-ai/omarchy-plugin-security-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Omarchy Plugin Security Skill does

Agent skill and field guide: the security pitfalls that block Omarchy plugins on the marketplace, from 5,000+ maintainer reviews.

Alternatives in Security

FastAPI Review — Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu 243.5k ★
Defense In Depth — Implement multi-layered testing and security best practices 98.1k ★
Google Workspace Alert Center — Manage security alerts 21.6k ★

README

omarchy-plugin-security-skill

![Ship plugins that pass review first time](assets/social.png)

An agent skill that keeps your [Omarchy](https://omarchy.org) plugin from getting `needs-fixes` on the [plugin marketplace](https://github.com/omacom/omarchy-plugin-marketplace).

**The guide itself is [`SKILL.md`](SKILL.md).** Read it there; this README only explains what it is and how to install it.

I analyzed all 5,130 submission issues in the marketplace repository and the roughly 5,500 comments the security maintainers left on them between July and September 2026 with Claude Fable, and turned every blocking finding into a rule, the exact fix reviewers ask for, and a checklist. It is written for coding agents (Claude Code, Codex, Cursor, OpenCode and anything else that reads `SKILL.md` files), but it is just as readable as a field guide for humans.

By the numbers

Six weeks of marketplace history, read end to end.


3,655 plugin submissions from 2,060 authors	plus 1,386 update and verification tickets
5,475 review comments from the maintainer accounts	3.3 MB of review text, median comment 511 characters
51% of submissions got at least one security finding	and 59% of the plugins that are listed today were blocked first
0.2 days to listing when clean, 1.0 day when blocked	every review round costs about a day
70 submissions blocked by the static baseline scanner	2,145 blocked by the review agent

That last row is the reason this skill exists. The static baseline catches `curl | sh`, unpinned git clones and dangerous sudoers rules. Everything else in the chart below was found by the marketplace's review agent, an AI reviewer run by the maintainer that reads the full tree at the exact commit and writes up each finding with file, line and the required fix. So this is an agent skill distilled from an agent's reviews, which is also why the fix wording is so consistent.