Sonatype Guide

Claude Code: /plugin marketplace add anthropics/claude-plugins-official → /plugin install sonatype-guide@claude-plugins-official

One skill, wired to fire before any package manager command or edit to a manifest — package.json, pyproject.toml, go.mod, pom.xml, Gemfile and the rest — rather than after the dependency is already sitting in the lockfile. It queries the index by Package URL and returns known vulnerabilities, license risk, a malicious-package flag and a trust score for each candidate version. Two of its rules exist because that result set is ranked by trust score and not by version number: a recommendation must never fall below what the project already runs, and a component marked malicious is never offered with a caveat or a supposedly safe usage. A reference table spells out purl syntax per ecosystem, which is where most failed lookups come from.