Add 42Crunch API security testing plugin

[heshaam-42c]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, or workflow file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, or workflow with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the staged branch for this pull request.

---

Description

Adds the 42Crunch API Security Testing plugin for GitHub Copilot.

Includes plugin metadata, README, and skills for API security testing workflows.

Validation/build run locally:

• npm run plugin:validate
• npm start

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• Update to existing instruction, prompt, agent, plugin, skill, or workflow.
• Other (please specify):

---

Additional Notes

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔍 Skill Validator Results

⚠️ Warnings or advisories found

Scope	Checked
Skills	5
Agents	1
Total	6
Severity	Count
---	---:
❌ Errors	0
⚠️ Warnings	2
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	Found 5 skill(s)
ℹ️	[42crunch-api-security-testing] 📊 42crunch-api-security-testing: 2,558 BPE tokens [chars/4: 2,524] (standard ~), 4 sections, 4 code blocks
ℹ️	[42crunch-api-security-testing] ⚠ Skill is 2,558 BPE tokens (chars/4 estimate: 2,524) — approaching "comprehensive" range where gains diminish.
ℹ️	[42crunch-audit] 📊 42crunch-audit: 1,035 BPE tokens [chars/4: 1,025] (detailed ✓), 3 sections, 1 code blocks
ℹ️	[42crunch-code-to-oas] 📊 42crunch-code-to-oas: 4,507 BPE tokens [chars/4: 4,283] (standard ~), 31 sections, 5 code blocks
ℹ️	[42crunch-code-to-oas] ⚠ Skill is 4,507 BPE tokens (chars/4 estimate: 4,283) — approaching "comprehensive" range where gains diminish.
ℹ️	[42crunch-scan] 📊 42crunch-scan: 1,963 BPE tokens [chars/4: 1,946] (detailed ✓), 4 sections, 4 code blocks
ℹ️	[42crunch-setup] 📊 42crunch-setup: 1,622 BPE tokens [chars/4: 1,587] (detailed ✓), 15 sections, 4 code blocks
ℹ️	✅ All checks passed (5 skill(s))

Full validator output

```text Found 5 skill(s) [42crunch-api-security-testing] 📊 42crunch-api-security-testing: 2,558 BPE tokens [chars/4: 2,524] (standard ~), 4 sections, 4 code blocks [42crunch-api-security-testing] ⚠ Skill is 2,558 BPE tokens (chars/4 estimate: 2,524) — approaching "comprehensive" range where gains diminish. [42crunch-audit] 📊 42crunch-audit: 1,035 BPE tokens [chars/4: 1,025] (detailed ✓), 3 sections, 1 code blocks [42crunch-code-to-oas] 📊 42crunch-code-to-oas: 4,507 BPE tokens [chars/4: 4,283] (standard ~), 31 sections, 5 code blocks [42crunch-code-to-oas] ⚠ Skill is 4,507 BPE tokens (chars/4 estimate: 4,283) — approaching "comprehensive" range where gains diminish. [42crunch-scan] 📊 42crunch-scan: 1,963 BPE tokens [chars/4: 1,946] (detailed ✓), 4 sections, 4 code blocks [42crunch-setup] 📊 42crunch-setup: 1,622 BPE tokens [chars/4: 1,587] (detailed ✓), 15 sections, 4 code blocks ✅ All checks passed (5 skill(s)) ```

[Copilot]

Pull request overview

This PR adds a new 42Crunch API security testing plugin to the Awesome Copilot marketplace, along with a set of 42Crunch-focused skills (setup, audit, scan, full pipeline, and code→OAS generation) and supporting reference docs.

Changes:

• Introduces five new 42Crunch skills covering environment setup, static audit, live scan, end-to-end pipeline orchestration, and OpenAPI generation from source.
• Adds a new 42crunch-api-security-testing plugin that bundles the skills and documents usage.
• Updates plugin/skill indexes and the marketplace registry to surface the new plugin and skills.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 31 comments.

Show a summary per file

File	Description
skills/42crunch-setup/SKILL.md	New setup skill for installing 42c-ast and configuring credentials.
skills/42crunch-setup/references/binary-setup.md	Reference procedure for installing/updating the 42c-ast binary.
skills/42crunch-setup/references/credential-setup.md	Reference procedure for storing platform/freemium credentials.
skills/42crunch-setup/references/pre-flight.md	Shared pre-flight checks (binary, credentials, OAS resolution, tags).
skills/42crunch-setup/references/tag-detection.md	Reference flow for resolving/assigning platform tags for an OAS.
skills/42crunch-audit/SKILL.md	New audit skill to run 42Crunch audit + SQG-driven fix loop.
skills/42crunch-audit/references/audit-rule-translations.md	Rule-id → plain English translation table for audit findings.
skills/42crunch-audit/references/audit-workflow.md	Detailed audit execution, parsing, consent, and fix workflow.
skills/42crunch-audit/references/binary-setup.md	Audit-local copy of the binary install/update reference.
skills/42crunch-audit/references/credential-setup.md	Audit-local copy of the credentials setup reference.
skills/42crunch-audit/references/pre-flight.md	Audit-local copy of the shared pre-flight checks.
skills/42crunch-audit/references/tag-detection.md	Audit-local copy of the platform tag resolution flow.
skills/42crunch-scan/SKILL.md	New scan skill to configure and run live conformance/authz testing.
skills/42crunch-scan/references/binary-setup.md	Scan-local copy of the binary install/update reference.
skills/42crunch-scan/references/credential-setup.md	Scan-local copy of the credentials setup reference.
skills/42crunch-scan/references/pre-flight.md	Scan-local copy of the shared pre-flight checks.
skills/42crunch-scan/references/scan-workflow.md	Detailed scan config generation, auth setup, scenarios, and runs.
skills/42crunch-scan/references/tag-detection.md	Scan-local copy of the platform tag resolution flow.
skills/42crunch-code-to-oas/SKILL.md	New skill to generate an OpenAPI 3.0 spec from an API codebase.
skills/42crunch-api-security-testing/SKILL.md	New orchestration skill for audit → scan pipeline with separate consent gates.
skills/42crunch-api-security-testing/references/audit-rule-translations.md	Pipeline-local copy of audit rule translation table.
skills/42crunch-api-security-testing/references/audit-workflow.md	Pipeline-local copy of the audit workflow reference.
skills/42crunch-api-security-testing/references/binary-setup.md	Pipeline-local copy of the binary install/update reference.
skills/42crunch-api-security-testing/references/credential-setup.md	Pipeline-local copy of the credentials setup reference.
skills/42crunch-api-security-testing/references/pre-flight.md	Pipeline-local copy of the shared pre-flight checks.
skills/42crunch-api-security-testing/references/tag-detection.md	Pipeline-local copy of the platform tag resolution flow.
plugins/42crunch-api-security-testing/.github/plugin/plugin.json	Plugin manifest declaring the included skills and metadata.
plugins/42crunch-api-security-testing/README.md	Plugin documentation (commands, setup, usage, configuration).
plugins/42crunch-api-security-testing/LICENSE	MIT license for the plugin content.
docs/README.skills.md	Adds the new 42Crunch skills to the skills index table.
docs/README.plugins.md	Adds the new 42Crunch plugin to the plugins index table.
.github/plugin/marketplace.json	Registers the new plugin in the marketplace listing.

[aaronpowell]

I notice that you also have the repo https://github.com/42Crunch-AI/copilot-plugins in which from my initial review the plugin is a mirror of.

This then begs the question of whether it's a good idea to have it in Awesome Copilot, as it could create a maintenance burden on yourselves to keep them in sync. Is it a fair assessment that the desire is discoverability through the Awesome Copilot marketplace?

[heshaam-42c]

Hi Aaron, yes you're correct. That is a marketplace repo we created to house the plugin. The intent for this PR was for discoverability in the Awesome Copilot marketplace, so that users have the option to add the plugin without necessarily needing to add the 42Crunch marketplace.