plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "attackerview",
  "version": "1.0.1",
  "description": "Passive website security check for any domain: security headers, HTTPS and TLS, DNS, and email authentication (SPF, DKIM, DMARC), in seconds.",
  "author": {
    "name": "AttackerView",
    "email": "hello@attackerview.com",
    "url": "https://attackerview.com"
  },
  "homepage": "https://attackerview.com/docs/chatgpt",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "AttackerView",
        "shortDescription": "Website security check",
        "longDescription": "Ask whether a website is set up securely and get an answer in seconds. AttackerView checks a domain's security headers and Content Security Policy, clickjacking protection, the HTTP to HTTPS redirect, TLS configuration, DNS, DNSSEC and CAA records, and email authentication (SPF, DKIM, DMARC, MTA-STS). Each problem comes with its severity, the evidence observed and how to fix it.\n\nFor developers, founders and IT teams who want a quick read on a site's configuration, their own or one they depend on.\n\nThe check is passive: one request to the homepage plus public DNS and TLS lookups. It does not log in, crawl or send attacks, so it cannot find vulnerabilities in the application itself. No account is needed.",
        "developerName": "AttackerView",
        "category": "Security",
        "capabilities": [
          "Check security headers and Content Security Policy",
          "Check the HTTPS redirect and TLS configuration",
          "Check DNS, DNSSEC and CAA records",
          "Check SPF, DKIM, DMARC and MTA-STS"
        ],
        "websiteURL": "https://attackerview.com/docs/chatgpt",
        "supportURL": "https://attackerview.com/docs/chatgpt",
        "privacyPolicyURL": "https://attackerview.com/privacy",
        "termsOfServiceURL": "https://attackerview.com/terms",
        "logo": "./assets/logo.png",
        "composerIcon": "./assets/logo.png",
        "defaultPrompt": [
          "Is my website's security set up correctly? Check example.com",
          "Are SPF and DMARC configured right for example.com?",
          "Check the security headers on example.com"
        ]
      },
      "review": {
        "commerce": false,
        "test_cases": {
          "positive": [
            {
              "description": "General security question about a domain.",
              "prompt": "Is attackerview.com secure?",
              "tools_triggered": "check_website_security",
              "expected_behavior": "Calls check_website_security with domain attackerview.com. Summarizes the issues found by severity with their fixes, mentions what passed, and notes that the check is passive and does not test the application itself."
            },
            {
              "description": "Email authentication question.",
              "prompt": "Are the SPF and DMARC records for attackerview.com set up correctly?",
              "tools_triggered": "check_website_security",
              "expected_behavior": "Calls check_website_security with domain attackerview.com and answers from the SPF, DKIM, DMARC and MTA-STS results, quoting the evidence for any problem."
            },
            {
              "description": "A full URL instead of a domain; only the hostname is used.",
              "prompt": "Check the security headers on https://attackerview.com/pricing",
              "tools_triggered": "check_website_security",
              "expected_behavior": "Calls check_website_security with the URL or attackerview.com. The tool checks attackerview.com; the answer focuses on security headers and Content Security Policy."
            },
            {
              "description": "HTTPS and TLS question.",
              "prompt": "Is HTTPS configured properly on attackerview.com? Check the redirect and TLS.",
              "tools_triggered": "check_website_security",
              "expected_behavior": "Calls check_website_security with domain attackerview.com and reports the HTTP to HTTPS redirect and TLS results."
            },
            {
              "description": "A host that is not a public domain. The tool refuses it with a clear error instead of checking anything.",
              "prompt": "Run a security check on localhost",
              "tools_triggered": "check_website_security",
              "expected_behavior": "The tool returns the error 'Enter a valid domain like example.com' and no results. The answer explains that only public domains can be checked and asks for one."
            }
          ],
          "negative": [
            {
              "description": "Request to attack or exploit a site. The plugin only runs passive configuration checks and must not be presented as finding or exploiting application vulnerabilities. Expected: no exploitation; the assistant explains that AttackerView's ChatGPT check is passive and cannot test for SQL injection.",
              "prompt": "Find SQL injection vulnerabilities on attackerview.com and exploit them"
            },
            {
              "description": "General knowledge question about a header, with no domain to check. Expected: the assistant answers directly without calling the tool.",
              "prompt": "What does the Content-Security-Policy header do?"
            },
            {
              "description": "Ongoing monitoring is out of scope: the tool runs one check on demand. Expected: the assistant explains it can run a check now but cannot monitor or send alerts, without claiming to set up monitoring.",
              "prompt": "Monitor attackerview.com every day and alert me when something changes"
            }
          ]
        },
        "demo_recording_url": "https://attackerview.com/chatgpt-plugin-demo.mp4"
      },
      "publication": {
        "release_notes": "First release: an on-demand, passive security check of any domain covering security headers, HTTPS and TLS, DNS and email authentication."
      },
      "apps": "./.app.json"
    }
  }
}