[External Plugin]: sechelix-lite

[omarmohelal]

Plugin name

sechelix-lite

Short description

Application-security review skill for codebases and pull requests you are authorized to assess. Maps trust boundaries, keeps issues as hypotheses until evidenced, runs a separate pass that tries to refute material findings, and ends with a release verdict.

GitHub repository

omarmohelal/SecHelix

Plugin path inside the repository

distributions/awesome-copilot

Ref to review

v4.0.0-alpha.6

Commit SHA to review

a73be865fccf5cefcf98d4dcce2c2bf2b6afce2f

Version

4.0.0-alpha.6

License identifier

Apache-2.0

Author name

Omar

Author URL

https://github.com/omarmohelal

Homepage URL

No response

Keywords

security
appsec
security-review
code-review
authorization
business-logic
supply-chain
ai-security

Additional notes for reviewers

This is a fresh submission after addressing the feedback on #2899. The public-directory package has been reduced to a focused AppSec skill: SKILL.md is now 197 lines with 5 supporting files (all Markdown references, no scripts). Product, runtime, SEO and cleanup material is intentionally excluded from this package, and the plugin path points at that package rather than the repository root.

It needs no runtime or network access. A CI check in the source repository keeps the package within 220 lines and 6 supporting files.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

• Plugin: sechelix-lite
• Repository: https://github.com/omarmohelal/SecHelix
• Ref: v4.0.0-alpha.6
• SHA: a73be865fccf5cefcf98d4dcce2c2bf2b6afce2f

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	14 day(s)
Repository activity	repository is 14 day(s) old; 0 watchers; 0 forks
Repository counts	1 stars · 0 watchers · 0 forks · 5 open issues/PRs

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	✅ pass
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: pass
• canvas structure: not_run
• overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ sechelix-lite (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-PcyCR8/copilot-home/.copilot/installed-plugins/external-plugin-intake/sechelix-lite/plugin.json.

Version match output

- v4.0.0-alpha.6: matched version "4.0.0-alpha.6" at "distributions/awesome-copilot/plugin.json".
- a73be865fccf5cefcf98d4dcce2c2bf2b6afce2f: matched version "4.0.0-alpha.6" at "distributions/awesome-copilot/plugin.json".

Ref/SHA consistency output

source.ref "v4.0.0-alpha.6" resolves to the same commit as source.sha "a73be865fccf5cefcf98d4dcce2c2bf2b6afce2f".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "sechelix-lite",
  "description": "Application-security review skill for codebases and pull requests you are authorized to assess. Maps trust boundaries, keeps issues as hypotheses until evidenced, runs a separate pass that tries to refute material findings, and ends with a release verdict.",
  "version": "4.0.0-alpha.6",
  "author": {
    "name": "Omar",
    "url": "https://github.com/omarmohelal"
  },
  "repository": "https://github.com/omarmohelal/SecHelix",
  "license": "Apache-2.0",
  "keywords": [
    "security",
    "appsec",
    "security-review",
    "code-review",
    "authorization",
    "business-logic",
    "supply-chain",
    "ai-security"
  ],
  "source": {
    "source": "github",
    "repo": "omarmohelal/SecHelix",
    "path": "distributions/awesome-copilot",
    "ref": "v4.0.0-alpha.6",
    "sha": "a73be865fccf5cefcf98d4dcce2c2bf2b6afce2f"
  }
}

View workflow run