Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add AgenticPawan/FullStack-Pilotnpx agentmods add plugins/agenticpawan/fullstack-pilot/marketplacegit clone --depth 1 https://github.com/AgenticPawan/FullStack-PilotGrade A, and why
fullstack-pilot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
{
"$schema": "https://json.schemastore.org/claude-code-marketplace.json",
"name": "fullstack-pilot",
"description": "Codebase governance for full-stack Microsoft shops (Angular, .NET, SQL Server, Azure)",
"owner": {
"name": "AgenticPawan",
"url": "https://github.com/AgenticPawan"
},
"metadata": {
"pluginRoot": "./plugins"
},
"plugins": [
{
"name": "pilot-core",
"source": "./plugins/pilot-core",
"description": "Shared governance for full-stack Microsoft shops: stack detection, /fsp-bootstrap baseline-module scaffolding (auth/authz/logging/error-handling/health-checks/CORS), and the fsp- pipelines (init, audit, fix, learn, architect, build) every other pilot plugin builds on. Adds MCP discovery, supply-chain/license policy, CI secret scanning, REST API standards, SLO load testing, and incident-response governance, plus the autonomous delivery team (fsp-analyst/scout/architect/qa) and the cross-stack @fullstack-reviewer/@fullstack-implementor/@fullstack-support trio.",
"author": { "name": "FullStack Pilot Contributors" },
"license": "MIT",
"keywords": ["governance", "commits", "code-health", "microsoft"]
},
{
"name": "pilot-angular",
"source": "./plugins/pilot-angular",
"description": "Angular / TypeScript governance for v15-20: signals and state, performance, WCAG 2.2 AA accessibility, UI/UX visual consistency, motion/reduced-motion, permissions-only route guards, OIDC/PKCE authentication, HTTP resilience, routing, SSR, coding standards, theming, shared UI libraries and JSON-schema dynamic forms, testing, i18n, global error handling, PWA/offline, telemetry, Nx/module-federation monorepo and lint governance, OpenAPI/NSwag clients, third-party scripts, feature flags, and NgRx — with @angular-reviewer, @angular-implementor, and @angular-support agents",
"author": { "name": "FullStack Pilot Contributors" },
"license": "MIT",
"keywords": ["angular", "typescript",What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 63 lines scan A a6ea3b0b69fc
fullstack-pilot is a plugin published in the GitHub repository AgenticPawan/FullStack-Pilot (2 stars, last pushed 1mo ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
azure-kusto-graph-skills
Kusto graph analysis, IRQL security hunting pipelines, and graph visualization skills for Azure Data Explorer.
handbook-agent-spec-kit
Spec-driven development workflow system with structured phases: Requirements → Design → Tasks → Implementation.
martinloop
Govern coding-agent work with budgets, stop conditions, and verifier-backed evidence.
smk
Plugin marketplace listing 13 plugins: cursor-delegate, spring-clean, portal-skills, readable, decode.
dmitriy-claude-plugins
Personal collection of Claude Code plugins for development workflows and productivity.
spring-clean
Two passes over a repo. spring-clean measures against a declared scoreboard, deletes or gitignores what does not belong, relocates dev docs, notes, clones and dumps to a -workspace repo, splits oversized files, draws package boundaries and writes its plan to a numbered unit list that survives a dead context. w.