[External Plugin]: eczid-sbom-cra-readiness

[Ecocitizenz]

Plugin name

eczid-sbom-cra-readiness

Short description

Free agent plugin, MIT-licensed: no purchase, account, sign-in, licence key or trial is required, and nothing it does is withheld pending a purchase. CRA reporting obligations apply from 11 September 2026. Review whether a repository holds the SBOM (CycloneDX or SPDX), lockfile, VEX / CSAF, disclosure-policy, provenance and release evidence needed to identify an affected component within the reporting window. Filename and path only. Free.

GitHub repository

Ecocitizenz/eczid-agent-plugins

Plugin path inside the repository

plugins/eczid-sbom-cra-readiness

Ref to review

No response

Commit SHA to review

ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374

Version

0.1.1

License identifier

MIT

Author name

EcoCitizenz Ltd

Author URL

https://developers.ecocitizenz.com

Homepage URL

https://developers.ecocitizenz.com/sbom/

Keywords

ecz-id
sbom
cra
cyber-resilience-act
cyclonedx
spdx
vex
supply-chain

Additional notes for reviewers

PRICING, STATED PLAINLY: this plugin is free and MIT-licensed. It installs and runs in full with no account, sign-in, licence key, trial or paywall, and it sells nothing.

EcoCitizenz separately sells Pro editions of its VS Code extensions and ECZ-ID Passports through TrustOps. Those are different products. This plugin does not sell, unlock, gate or require any of them, and it never runs checkout or grants entitlement. Where a paid route is genuinely the next step for a result, the plugin links to it, clearly labelled optional, below the free capability it has already given.

The README has been corrected at the generator so this cannot be misread: it opens with "Free agent plugin. No purchase required.", every price sits below the doctrine and privacy sections under an explicit "Optional and separate ... a different product" heading, and suggested next actions are split into free routes and clearly-labelled optional paid ones. Tests fail the build if a price appears above the free statement.

Agent Plugins 1.0.0 package with one skill and a dependency-free Node review script (file names and paths only; no file opened, no SBOM parsed, no network, nothing written). Regulatory wording is quoted from the EUR-Lex text of Regulation (EU) 2024/2847: Article 14 applies from 11 September 2026, the Regulation as a whole from 11 December 2027; the plugin never states that a user is compliant, certified or ready. Same detectors, guidance and Review Priority as the ECZ-ID SBOM & CRA Readiness VS Code extension 0.3.0 (Marketplace and Open VSX).

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

• Plugin: eczid-sbom-cra-readiness

• Repository: https://github.com/Ecocitizenz/eczid-agent-plugins

• SHA: ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	0 day(s)
Repository activity	repository is 0 day(s) old; 0 stars; 0 watchers; 0 forks
Repository counts	0 stars · 0 watchers · 0 forks · 0 open issues/PRs
Homepage heuristics	⚠️ checkout

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	⚪ not_run
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: not_run
• canvas structure: not_run
• overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ sbom-cra-evidence-review (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-EUf3Th/copilot-home/.copilot/installed-plugins/external-plugin-intake/eczid-sbom-cra-readiness/plugin.json.

Version match output

- ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374: matched version "0.1.1" at "plugins/eczid-sbom-cra-readiness/plugin.json".

Ref/SHA consistency output

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "eczid-sbom-cra-readiness",
  "description": "Free agent plugin, MIT-licensed: no purchase, account, sign-in, licence key or trial is required, and nothing it does is withheld pending a purchase. CRA reporting obligations apply from 11 September 2026. Review whether a repository holds the SBOM (CycloneDX or SPDX), lockfile, VEX / CSAF, disclosure-policy, provenance and release evidence needed to identify an affected component within the reporting window. Filename and path only. Free.",
  "version": "0.1.1",
  "author": {
    "name": "EcoCitizenz Ltd",
    "url": "https://developers.ecocitizenz.com"
  },
  "repository": "https://github.com/Ecocitizenz/eczid-agent-plugins",
  "homepage": "https://developers.ecocitizenz.com/sbom/",
  "license": "MIT",
  "keywords": [
    "ecz-id",
    "sbom",
    "cra",
    "cyber-resilience-act",
    "cyclonedx",
    "spdx",
    "vex",
    "supply-chain"
  ],
  "source": {
    "source": "github",
    "repo": "Ecocitizenz/eczid-agent-plugins",
    "path": "plugins/eczid-sbom-cra-readiness",
    "sha": "ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374"
  }
}

View workflow run

[aaronpowell]

/reject Sorry, we're not a channel for purely paid services.

[github-actions]

❌ External plugin rejected

A maintainer rejected eczid-sbom-cra-readiness, and the submission issue has been closed.

Reason

Sorry, we're not a channel for purely paid services.

If you address the feedback, edit this issue with the updated details and have the issue author or a maintainer comment /rerun-intake to re-run automated intake.

[Ecocitizenz]

/rerun-intake

Thank you for reviewing, and sorry for the confusion — the wording was ours, not a misreading on your part.

To state it plainly: this Agent Plugin is free. It is MIT-licensed and installs and runs in full with no account, no sign-in, no licence key, no trial and no paywall. Nothing it does is withheld pending a purchase, and the plugin sells nothing and runs no checkout. It is useful on its own: it performs a local, filename-and-path-only review and reports evidence with a deterministic Review Priority — no source upload, no telemetry.

We do sell separate products (Pro editions of our VS Code extensions, and ECZ-ID Passports through TrustOps). Those are different products, and this plugin neither requires nor unlocks them.

The README is what invited the other reading, and it is fixed at the generator rather than by editing text:

• it now opens with "Free agent plugin. No purchase required.", above everything else;
• every price has moved below the doctrine and privacy sections, under an explicit "Optional and separate … a different product" heading;
• suggested next actions are split into free routes and clearly-labelled optional paid ones;
• tests now fail the build if a price appears above the free statement, so this cannot regress.

The issue is updated to the corrected commit ea0f04a4aa3d9f7b77753cd5d9380d34cbc2d374. It is submitted as a SHA only so the v0.1.1 tag stays immutable; the plugin version is unchanged at 0.1.1.

Requesting one reconsideration through the documented mechanism. If the answer is still no, that is completely fine and we will not press it further.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.