Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add beel-es/claude-pluginsnpx agentmods add plugins/beel-es/claude-plugins/marketplacegit clone --depth 1 https://github.com/beel-es/claude-pluginsGrade A, and why
beel scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
{
"name": "beel",
"owner": {
"name": "BeeL",
"email": "[email protected]"
},
"metadata": {
"description": "Official BeeL plugins for Claude Code"
},
"plugins": [
{
"name": "beel-api",
"source": "./plugins/beel-api",
"description": "BeeL. invoicing API toolkit: docs-first integration guide plus skills to implement, audit, upgrade, webhook-enable and integrate the multi-NIF model of a BeeL integration. Activates automatically when working with the BeeL. API.",
"version": "1.4.0",
"author": {
"name": "BeeL",
"email": "[email protected]"
},
"homepage": "https://docs.beel.es/docs/claude-code",
"repository": "https://github.com/beel-es/claude-plugins"
},
{
"name": "stripe",
"source": "./plugins/stripe",
"description": "Audits a Stripe integration for security issues and antipatterns: missing webhook signature verification, missing idempotency keys, outdated API versions, broken subscription/proration logic, leaked or over-scoped keys. Read-only. Produces a structured report.",
"version": "0.1.0",
"author": {
"name": "BeeL",
"email": "[email protected]"
},
"homepage": "https://beel.es",
"repository": "https://github.com/beel-es/claude-plugins"
},
{
"name": "compliance-es",
"source": "./plugins/compliance-es",
"description": "Audita un repo y genera, sin abogado, la documentación de cumplimiento legal de un SaaS o empresa en España: protección de datos (RGPD + LOPDGDD), LSSI (aviso legal, cookies, contratación electrónica y registro de aceptaciones), compliance penal (art. 31 bis CP + canal de denuncias Ley 2/2023) y facturación antifraude (Veri*Factu). Cada conclusión cita el artículo de la norma. Multi-marco (packs) y con estado versionado. Incluye un radar de marcos emergentes (Data Act, accesibilidad, AI Act, NIS2).",
"version": "0.2.0",
"author": {
"name": "BeeL",
"emaiWhat this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 61 lines scan A 4aa049e15cb8
beel is a plugin published in the GitHub repository beel-es/claude-plugins (4 stars, last pushed 6d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
csrd
EU CSRD (Corporate Sustainability Reporting Directive, EU 2022/2464) compliance advisor — scope & threshold analysis (large PIEs, other large, listed SMEs, non-EU), double materiality assessment (DMA), ESRS gap assessment, ESRS E1–E5 environmental disclosures, ESRS S1–S4 social disclosures, ESRS G1 governance, Scope…
eu-cra
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847. Covers product classification (Default/Class I/Class II), Annex I essential requirements gap analysis, conformity assessment (self-assessment vs Notified Body), CE marking, SBOM, vulnerability handling, 24/72-hour ENISA reporting, support…
dora
DORA (Regulation (EU) 2022/2554) compliance advisor for EU financial entities — ICT risk management framework, incident classification and reporting, TLPT, ICT third-party risk, Register of Information, and all adopted RTS/ITS with article-level citations.
fedramp
End-to-end FedRAMP authorization guidance under CR26 — Certification Classes A-D, FedRAMP 20x pathway, readiness assessments, SSP narratives, POA&M management, NIST 800-53 Rev 5 control mapping, OSCAL mandate, and ConMon support.
ism
Expert Australian Information Security Manual (ISM) advisor for Australian government entities, contractors and supply chains. Gap analysis, system authorisation, IRAP preparation, control scoping, and ASD compliance guidance.
nzism
Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies. Gap analysis, system certification & accreditation, classification framework guidance, control implementation, and GCSB/NCSC NZ compliance.