Play · Security teams
Vet Claude skills and plugins before install
Each skill scannedand each plugin decidedbefore it runs.
A plugin can run code on every session: hooks, MCP servers, scripts. Waxell scans each upload before anyone decides on it, passes clean ones on your policy, sends the rest to a person, and publishes the approved set to where your people use Claude.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
- This play uses
- 01Discover
- 03Enforce
- 05Prove
Who
A security team at a company on Claude where engineers trade Claude Code plugins in Slack and nobody reviews them.
What happened
A plugin with a session-start hook turned up in a dozen checkouts, and nobody could say what the script it called actually did.
What's at stake
A plugin that reads ~/.ssh or sends data to an outside URL installs with the same two commands as a harmless one, and there is no record of who let it in.
- 01Discover
One queue for everything that comes in.
An admin uploads a SKILL.md, a zipped skill folder, or a zipped Claude Code plugin (a folder with .claude-plugin/plugin.json) in Govern under Skills & Plugins; a member requests one from Connect under Skills and says what it is for. Every upload is scanned before anyone decides on it, with SkillSpector plus Waxell's own checks on how each MCP server is launched, what a skill tells Claude to install, and every binary file by what its bytes are. A plugin's hooks are followed into the scripts they call, so a harmless-looking hooks.json that runs hooks/run.sh is reported against hooks/run.sh. The result is a verdict of Safe, Caution or Do not install, a risk score from 0 to 100, and each finding with its severity, file and line.
prompt injection · credential access · data exfiltration · remote code execution · hooks followed into scripts · up to 8 MB zipped, 500 files
- 02Enforce
Clean scans approve themselves. Code that runs goes to a person.
Auto-approval is off by default; turn it on in Settings under Auto-approval and a submission is approved on its own only when every rule holds: the verdict is Safe, the risk score is at or below 20, no finding is at High or above, and the plugin bundles no hooks, MCP servers or scripts unless you say those may pass too. A Do not install verdict goes to review by default, or is rejected automatically with the reason recorded; an admin can still Approve anyway. A scan that fails or has not come back within 15 minutes always goes to a person. Revoke takes a plugin back out of every destination it was published to.
verdict Safe · risk score at or below 20 · no High finding · hooks, MCP servers and scripts to a person by default · 15-minute scan window · revoke everywhere
- 03Prove
Published where people use Claude, with the decision on record.
The approved set is served to Claude Code as a private marketplace called waxell-approved, and to Claude Desktop, Cowork and claude.ai through a GitHub or GitLab repository that claude.ai syncs; Waxell commits every approval and revoke, and the repository history says what changed and by whom. Members see Approved for you in Connect under Skills with the install line for each plugin, and track their own requests through Scanning, Waiting for review, Approved, Not approved and Revoked. Every decision the policy makes carries its reason in the drawer, to the requester, and in your audit log, and a change to the policy itself is audited with the old and new values.
waxell-approved marketplace · GitHub or GitLab sync · Approved for you · reason on every decision · policy changes audited
connect · workspace
- pdf-summarizer · SKILL.md · scangovern · skills & plugins · upload by s.okafor · auto-approved by policy: scanner verdict safe (0/100)allow
- repo-janitor plugin · hooks/run.sh on session startconnect · skills · request by t.alvarez · bundles hooks · to a personhold
- deploy-helper plugin · MCP server launches curl | shconnect · skills · request by m.lindqvist · Do not install · downloads a script and pipes it to a shell · Criticalblock
- brand-kit skill · template.docxgovern · skills & plugins · upload by s.okafor · Office file with macros · Critical · to a personhold
Illustrative entries in the shape the product writes them.
Products in this play
Prompt injection, credential access such as reading ~/.ssh or ~/.aws, data exfiltration to an outside URL, remote code execution, code that runs on its own, and risky dependencies. Waxell adds its own findings for how each MCP server is launched, what a skill tells Claude to install, and every binary file in the package. Scanning is static analysis; tenant content is not sent to a language model.
Run this play this week.
Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF