# claude-code-minimal-plugin 0.6.0

Claude Code skills for the Minimal developer system, with the eval pipeline that keeps them honest

Made by Canadians.

Snapshot of gominimal/pkgs commit `673744d03aea823593e5a5ce18b9526d29f20040` (pushed 2026-10-12T19:03:44.000Z).

## Install

```sh
min add claude-code-minimal-plugin
```

## Direct advisories

None at this commit.

## Transitive advisories

3 advisories inherited through runtime dependencies:

- CVE-2026-18477 (MEDIUM) via claude-code → base → tar
- CVE-2026-18508 (MEDIUM) via claude-code → base → tar
- CVE-2026-77214 (HIGH) via claude-code → git → expat

## Dependencies

- Build (1): base
- Runtime (1): claude-code

## OpenSSF Scorecard

Aggregate score: 4.5 / 10. Scored by Minimal using the OpenSSF Scorecard tool; OpenSSF does not scan this repository, so this is not a score OpenSSF published. Repository scored: gominimal/minimal-skills. Scanned 2026-10-12.

Checks, scored 0-10 as the Scorecard tool reports them (N/A: not applicable or inconclusive):

| Check | Score | Reason |
| --- | --- | --- |
| [Binary-Artifacts](https://minimal.dev/docs/reference/scorecard#check-binary-artifacts) | 10 | No binaries found in the repo |
| [Branch-Protection](https://minimal.dev/docs/reference/scorecard#check-branch-protection) | 0 | Branch protection not enabled on development/release branches |
| [CI-Tests](https://minimal.dev/docs/reference/scorecard#check-ci-tests) | N/A | Could not be evaluated |
| [CII-Best-Practices](https://minimal.dev/docs/reference/scorecard#check-cii-best-practices) | 0 | No effort to earn an OpenSSF best practices badge detected |
| [Code-Review](https://minimal.dev/docs/reference/scorecard#check-code-review) | 6 | Found 6/9 approved changesets -- score normalized to 6 |
| [Contributors](https://minimal.dev/docs/reference/scorecard#check-contributors) | 3 | Project has 1 contributing companies or organizations -- score normalized to 3 |
| [Dangerous-Workflow](https://minimal.dev/docs/reference/scorecard#check-dangerous-workflow) | 10 | No dangerous workflow patterns detected |
| [Dependency-Update-Tool](https://minimal.dev/docs/reference/scorecard#check-dependency-update-tool) | 0 | No update tool detected |
| [Fuzzing](https://minimal.dev/docs/reference/scorecard#check-fuzzing) | 0 | Project is not fuzzed |
| [License](https://minimal.dev/docs/reference/scorecard#check-license) | 10 | License file detected |
| [Maintained](https://minimal.dev/docs/reference/scorecard#check-maintained) | 0 | Project was created within the last 90 days. Please review its contents carefully |
| [Packaging](https://minimal.dev/docs/reference/scorecard#check-packaging) | N/A | Packaging workflow not detected |
| [Pinned-Dependencies](https://minimal.dev/docs/reference/scorecard#check-pinned-dependencies) | 1 | Dependency not pinned by hash detected -- score normalized to 1 |
| [SAST](https://minimal.dev/docs/reference/scorecard#check-sast) | N/A | Could not be evaluated |
| [Security-Policy](https://minimal.dev/docs/reference/scorecard#check-security-policy) | 0 | Security policy file not detected |
| [Signed-Releases](https://minimal.dev/docs/reference/scorecard#check-signed-releases) | N/A | No releases found |
| [Token-Permissions](https://minimal.dev/docs/reference/scorecard#check-token-permissions) | 10 | GitHub workflow tokens follow principle of least privilege |
| [Vulnerabilities](https://minimal.dev/docs/reference/scorecard#check-vulnerabilities) | 7 | 3 existing vulnerabilities detected |

## Links

- Package page (HTML): https://minimal.dev/pkgs/claude-code-minimal-plugin
- JSON API (floats latest): https://minimal.dev/api/pkgs/claude-code-minimal-plugin.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/claude-code-minimal-plugin/sbom.json
- Build attestations (JSON): https://minimal.dev/api/pkgs/claude-code-minimal-plugin/attestation.json