plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "scamcheck",
  "version": "0.1.0",
  "description": "Analyze a message, a link or a sender for fraud/phishing risk signals with a deterministic heuristic model, and get safety tips and official reporting resources. An analysis of risk signals, not a guaranteed verdict; read-only, stateless, no account.",
  "author": {
    "name": "mmcco",
    "email": "infodev@mmcco.co",
    "url": "https://scamcheck.mmcco.co"
  },
  "homepage": "https://scamcheck.mmcco.co",
  "license": "MIT",
  "keywords": [
    "security",
    "fraud",
    "phishing",
    "scam",
    "safety",
    "url",
    "email"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "ScamCheck",
        "shortDescription": "Spot fraud & phishing signals",
        "longDescription": "ScamCheck analyzes a message (email, SMS, private message), a single link or domain, or a sender (email address or number) and returns the fraud and phishing risk signals it detects \u2014 for example urgency and pressure, a request to pay or to click, a shortened link, a raw IP address, a missing HTTPS, a look-alike or free-address domain. It uses a deterministic heuristic model: the same input always gives the same signals, nothing is generated by a language model, no account is needed, nothing is stored and no file is read. The result is an ANALYSIS of risk signals, not a guaranteed verdict: a high number of signals suggests caution, but the absence of a signal does not prove a message is safe. ScamCheck also returns practical safety tips and official reporting resources (the Canadian Anti-Fraud Centre). It is an information and prevention tool; it does not contact anyone, does not report on your behalf and does not open attachments.",
        "developerName": "mmcco",
        "category": "Security",
        "capabilities": [
          "Analyzes a message, link or sender and flags fraud/phishing risk signals with a deterministic heuristic model.",
          "Returns an analysis of risk signals, not a guaranteed verdict; absence of a signal does not prove a message safe.",
          "Also gives fraud safety tips and official reporting resources. Read-only, stateless, no account, no files read."
        ],
        "websiteURL": "https://scamcheck.mmcco.co",
        "supportURL": "https://scamcheck.mmcco.co",
        "privacyPolicyURL": "https://scamcheck.mmcco.co/privacy",
        "termsOfServiceURL": "https://scamcheck.mmcco.co/terms",
        "defaultPrompt": [
          "Is this text a scam? 'Your parcel is on hold, pay a $2 fee at bit.ly/abc to release it.'",
          "Does this sender look legit: support@paypa1-secure.com?",
          "I think I was phished. What should I do?"
        ],
        "composerIcon": "./assets/icon.png",
        "logo": "./assets/logo.png"
      },
      "review": {
        "demo_recording_url": "https://scamcheck.mmcco.co/demo.gif",
        "test_cases": {
          "positive": [
            {
              "description": "Analyze a suspicious SMS",
              "prompt": "Is this text a scam? 'Your parcel is on hold, pay a $2 fee at bit.ly/abc to release it.'",
              "tools_triggered": "analyser_message",
              "expected_behavior": "Calls analyser_message; returns the detected signals (urgency, payment request, shortened link) with a risk level, and states explicitly that this is an analysis of signals, not a guaranteed verdict. Read-only."
            },
            {
              "description": "Analyze a risky URL",
              "prompt": "Is this link dangerous: http://192.168.0.10/login ?",
              "tools_triggered": "analyser_url",
              "expected_behavior": "Calls analyser_url; flags signals such as a raw IP address and missing HTTPS, returns a risk level, and notes that no signal found would not prove the link safe. Read-only."
            },
            {
              "description": "Analyze a look-alike sender",
              "prompt": "Does this sender look legit: support@paypa1-secure.com ?",
              "tools_triggered": "analyser_expediteur",
              "expected_behavior": "Calls analyser_expediteur; flags look-alike/typosquat and related signals, returns a risk level as an analysis (not a verdict), without asserting the sender is definitely fraudulent. Read-only."
            },
            {
              "description": "Ask what to do after a suspected phishing",
              "prompt": "I think I was phished. What should I do?",
              "tools_triggered": "conseils_securite",
              "expected_behavior": "Calls conseils_securite; returns practical fraud safety tips and official reporting resources (Canadian Anti-Fraud Centre). It does not report on the user's behalf. Read-only."
            },
            {
              "description": "Analyze a benign message",
              "prompt": "Analyze this message: 'Hi, see you at 3pm for coffee.'",
              "tools_triggered": "analyser_message",
              "expected_behavior": "Calls analyser_message; returns few or no risk signals and a low risk level, but states explicitly that the absence of signals does not prove the message is safe. Read-only."
            }
          ],
          "negative": [
            {
              "description": "General knowledge (out of scope)",
              "prompt": "What is the capital of France?",
              "expected_behavior": "No ScamCheck tool is triggered: this is pure general-knowledge Q&A with nothing to analyze for fraud."
            },
            {
              "description": "Act on the user's behalf (out of scope)",
              "prompt": "Report this scammer to the police and block their number for me.",
              "expected_behavior": "No ScamCheck tool is triggered: ScamCheck cannot report, contact anyone or block numbers; it can only analyze and give official reporting resources."
            },
            {
              "description": "Open an attachment (out of scope)",
              "prompt": "Open the attached PDF and scan it for scams.",
              "expected_behavior": "No ScamCheck tool is triggered: ScamCheck does not read or open files; it analyzes a message text, a URL or a sender provided in the conversation."
            }
          ]
        }
      },
      "publication": {
        "release_notes": "Initial release. ScamCheck analyzes a message, a link or a sender for fraud and phishing risk signals with a deterministic heuristic model, and returns safety tips and official reporting resources (Canadian Anti-Fraud Centre). The four tools (analyser_message, analyser_url, analyser_expediteur, conseils_securite) are read-only and stateless; no account, nothing stored, no files read. The result is an analysis of risk signals, not a guaranteed verdict: the absence of a signal does not prove a message is safe."
      },
      "apps": "./.app.json"
    }
  }
}