forked from molecule-ai/molecule-core
45e4eb0be3
Closes #256. Per CEO direction, shipping three separate opt-in plugins instead of one bundled "compliance-posture" — keeps installs granular so a workspace that only wants CVE scanning doesn't carry OWASP policy or append-only audit retention. - plugins/molecule-compliance/ — wraps compliance.py (OWASP OA-01 prompt injection + OA-03 excessive agency). Skill: owasp-agentic. - plugins/molecule-audit/ — wraps audit.py (EU AI Act Art. 12/13/17 append-only JSONL log, SIEM-friendly). Skill: ai-act-audit-log. - plugins/molecule-security-scan/ — wraps security_scan.py (Snyk or pip-audit CVE gate on skill requirements.txt). Skill: skill-cve-gate. Each plugin ships a manifest + one SKILL.md with: - When to install / when to skip - Configuration shape (config.yaml blocks) - Anti-patterns to avoid - Cross-references to the other two plugins so an operator can reason about the full compliance surface All three wrap code that already exists in workspace-template/builtin_tools/ — no Python changes. Install per workspace via POST /workspaces/:id/plugins {"source":"builtin://molecule-<name>"}. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| browser-automation | ||
| ecc | ||
| molecule-audit | ||
| molecule-audit-trail | ||
| molecule-careful-bash | ||
| molecule-compliance | ||
| molecule-dev | ||
| molecule-freeze-scope | ||
| molecule-hitl | ||
| molecule-prompt-watchdog | ||
| molecule-security-scan | ||
| molecule-session-context | ||
| molecule-skill-code-review | ||
| molecule-skill-cron-learnings | ||
| molecule-skill-cross-vendor-review | ||
| molecule-skill-llm-judge | ||
| molecule-skill-update-docs | ||
| molecule-workflow-retro | ||
| molecule-workflow-triage | ||
| superpowers | ||