cc-plugins

Security audit of a third-party package (npm, pip, homebrew, cargo, gem…) before using it. Fetches its source code, scans for malicious or suspicious patterns (outbound network calls, telemetry, eval/exec, install hooks, opaque file writes, supply-chain risks), then recursively audits same-author dependencies found in the package manifest. Use when the user says "is this package safe", "audit this dependency", "check this npm/pip/brew package", "can I trust this library", or asks whether a package is trustworthy before adding it to a project.

Enforce type-safe TypeScript patterns with Zod validation, pattern matching, and discriminated unions to prevent runtime errors. Use when writing TypeScript code, reviewing for type safety, designing data validation flows, or refactoring to eliminate impossible states.