Harden plugin packaging for HOL scanner listing

.codex-plugin/plugin.json

@@ -31,14 +31,19 @@
       "Write"
     ],
     "websiteURL": "https://github.com/HKUSTDial/DataMagic",
-    "privacyPolicyURL": "https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement",
-    "termsOfServiceURL": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service",
+    "privacyPolicyURL": "https://github.com/HKUSTDial/DataMagic/blob/main/SECURITY.md",
+    "termsOfServiceURL": "https://github.com/HKUSTDial/DataMagic/blob/main/LICENSE",
     "defaultPrompt": [
       "Make a narrated data video from this CSV",
       "Create a DVSpec plan for this table",
       "Refine this data-video storyboard"
     ],
     "brandColor": "#2563EB",
-    "screenshots": []
+    "composerIcon": "./assets/datamagic_logo.png",
+    "logo": "./assets/datamagic_logo.png",
+    "screenshots": [
+      "./assets/framework-1.png",
+      "./images/template-gallery.png"
+    ]
   }
 }

.codexignore

@@ -0,0 +1,7 @@
+.DS_Store
+.env
+.env.*
+*.log
+node_modules/
+.venv/
+__pycache__/

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/docs.yml

@@ -25,9 +25,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "20"
 
@@ -42,9 +44,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Collect changed Markdown files
         id: changed

.github/workflows/plugin-scanner.yml

@@ -0,0 +1,24 @@
+name: Plugin Security Scan
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: hashgraph-online/ai-plugin-scanner-action@caba2e96aa8ad2feb6cf6fca52442b52e22e779f # v1.2.635
+        with:
+          plugin_dir: "."
+          min_score: 80
+          fail_on_severity: high

CONTRIBUTING.md

@@ -3,7 +3,7 @@
 Thanks for your interest in DataMagic. The repo is currently **docs-first** —
 the production product lives at [datamagic.chat](https://datamagic.chat/), while this
 repository holds the public documentation, the published paper artifacts, and the
-[`datamagic-video`](./datamagic-video/) skill for AI coding agents.
+[`datamagic-video`](./skills/datamagic-video/) skill for AI coding agents.
 
 So contributions today land in one of four buckets:
 
@@ -40,19 +40,21 @@ npx --yes markdown-link-check@3.12.2 -c .markdown-link-check.json README.md
   shared sections (links, badges, examples, roadmap).
 - For per-doc Chinese / English pairs under `docs/`, edit both files in the same PR.
 - Don't add new top-level files unless necessary — prefer extending an existing doc.
-- The `datamagic-video` skill has its own conventions; read `datamagic-video/SKILL.md`
+- The `datamagic-video` skill has its own conventions; read `skills/datamagic-video/SKILL.md`
   before adding or restructuring rules there.
 
 ## CI
 
-Every push and PR runs the `docs` workflow ([.github/workflows/docs.yml](./.github/workflows/docs.yml)):
+Every push and PR runs:
 
-- **markdownlint** — across the whole repo, using `.markdownlint.json`
-- **link check** — only the Markdown files changed in the PR, using
-  `.markdown-link-check.json`
+- `docs` ([.github/workflows/docs.yml](./.github/workflows/docs.yml)): markdownlint and link check
+- `Plugin Security Scan` ([.github/workflows/plugin-scanner.yml](./.github/workflows/plugin-scanner.yml)): HOL plugin scanner, score ≥ 80
 
-Both jobs run on Node 20 and finish in well under a minute. Please make sure they
-pass locally before opening a PR.
+Please make sure they pass locally before opening a PR. For a local scanner preflight:
+
+```bash
+pipx run plugin-scanner scan .
+```
 
 ## Reporting issues
 

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HKUST Dial Lab and DataMagic contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.en.md

@@ -9,6 +9,7 @@
 [![IEEE VIS 2026](https://img.shields.io/badge/IEEE_VIS_2026-Accepted-007b8f)](https://ieeevis.org/)
 [![arXiv](https://img.shields.io/badge/arXiv-2606.20388-b31b1b)](https://arxiv.org/abs/2606.20388)
 [![docs](https://github.com/HKUSTDial/DataMagic/actions/workflows/docs.yml/badge.svg)](https://github.com/HKUSTDial/DataMagic/actions/workflows/docs.yml)
+[![plugin-scanner](https://github.com/HKUSTDial/DataMagic/actions/workflows/plugin-scanner.yml/badge.svg)](https://github.com/HKUSTDial/DataMagic/actions/workflows/plugin-scanner.yml)
 ![Status](https://img.shields.io/badge/status-live-brightgreen)
 
 [中文](./README.md) | [English](./README.en.md)
@@ -240,6 +241,10 @@ If you find DataMagic useful in your research or work, please cite:
 }
 ```
 
+## 📄 License
+
+This repository is released under the MIT License. See [LICENSE](./LICENSE). Report security issues privately using [SECURITY.md](./SECURITY.md).
+
 ## 📚 Documentation
 
 - [Data-Video Skill](./skills/datamagic-video/README.md)

README.md

@@ -9,6 +9,7 @@
 [![IEEE VIS 2026](https://img.shields.io/badge/IEEE_VIS_2026-Accepted-007b8f)](https://ieeevis.org/)
 [![arXiv](https://img.shields.io/badge/arXiv-2606.20388-b31b1b)](https://arxiv.org/abs/2606.20388)
 [![docs](https://github.com/HKUSTDial/DataMagic/actions/workflows/docs.yml/badge.svg)](https://github.com/HKUSTDial/DataMagic/actions/workflows/docs.yml)
+[![plugin-scanner](https://github.com/HKUSTDial/DataMagic/actions/workflows/plugin-scanner.yml/badge.svg)](https://github.com/HKUSTDial/DataMagic/actions/workflows/plugin-scanner.yml)
 ![Status](https://img.shields.io/badge/状态-上线中-brightgreen)
 
 [中文](./README.md) | [English](./README.en.md)
@@ -234,6 +235,10 @@ curl -fsSL https://raw.githubusercontent.com/HKUSTDial/DataMagic/main/install.sh
 }
 ```
 
+## 📄 许可证
+
+本仓库以 MIT License 开源，详见 [LICENSE](./LICENSE)。安全问题请按 [SECURITY.md](./SECURITY.md) 私下报告。
+
 ## 📚 文档
 
 - [数据视频 Skill](./skills/datamagic-video/README.md)

SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| `main`  | Yes |
+| `0.1.x` | Yes |
+
+This repository publishes documentation and the `datamagic-video` skill for coding agents. The hosted product at [datamagic.chat](https://datamagic.chat/) is operated separately.
+
+## Reporting a Vulnerability
+
+Please do **not** open a public GitHub issue for security reports.
+
+Prefer one of these private channels:
+
+1. GitHub private vulnerability reporting: [Open a security advisory](https://github.com/HKUSTDial/DataMagic/security/advisories/new)
+2. If that form is unavailable, email the maintainers through the HKUST Dial Lab contact listed on the [project homepage](https://datamagic-home.github.io)
+
+Include:
+
+- A description of the issue and its impact
+- Reproduction steps or a proof of concept
+- Affected files, skill instructions, or workflow names
+- Whether the issue is in this repository, the skill package, or the hosted product
+
+## Response
+
+We aim to acknowledge reports within 3 business days and to share a remediation plan or status update within 7 days. Critical issues that affect users of the skill or plugin packaging are prioritized first.
+
+Please give us a reasonable window to patch before any public disclosure.