| 1 | # Plugin Scanner |
| 2 | |
| 3 | Run an LLM-guided security review of third-party Agent Zero plugins from a Git repository. |
| 4 | |
| 5 | ## What It Does |
| 6 | |
| 7 | This plugin builds a structured scanning prompt from a selectable checklist, runs that prompt in a temporary agent context, and returns a markdown report describing the plugin's security posture. |
| 8 | |
| 9 | ## Main Behavior |
| 10 | |
| 11 | - **Prompt-driven scan** |
| 12 | - Loads scan checks and a markdown prompt template from the plugin's `webui/` assets. |
| 13 | - **Temporary scan context** |
| 14 | - Creates a temporary chat context, logs the generated prompt into it, starts the agent immediately, and waits for the model result. |
| 15 | - **Parallel-friendly execution** |
| 16 | - Each scan runs in its own chat context; the plugin does not serialize scans behind a "wait for another scan" queue. |
| 17 | - **Selectable checks** |
| 18 | - Supports scanning all checks by default or only the subset selected by the caller. |
| 19 | - **UI integration** |
| 20 | - Includes API endpoints and web UI files for logging the prompt, starting the scan, and running scans synchronously. |
| 21 | |
| 22 | ## Key Files |
| 23 | |
| 24 | - **Scan runner** |
| 25 | - `api/plugin_scan_run.py` performs a synchronous end-to-end scan and returns the report. |
| 26 | - **Prompt builder** |
| 27 | - `helpers/prompt.py` loads check definitions and renders the final scan prompt. |
| 28 | - **Additional APIs** |
| 29 | - `api/plugin_scan_queue.py` logs the prompt into the temporary chat. |
| 30 | - `api/plugin_scan_start.py` starts the agent in that chat. |
| 31 | |
| 32 | ## Configuration Scope |
| 33 | |
| 34 | - **Settings sections**: none |
| 35 | - **Per-project config**: `false` |
| 36 | - **Per-agent config**: `false` |
| 37 | |
| 38 | ## Plugin Metadata |
| 39 | |
| 40 | - **Name**: `_plugin_scan` |
| 41 | - **Title**: `Plugin Scanner` |
| 42 | - **Description**: Security scanner for third-party A0 plugins. |