Review policy & safety

In PKU harness, the agent acts for a student with that student's campus identity. Plugins add to what the agent can do, so every plugin, official or community, has to meet the same rules. This page lists those rules, explains what the "verified" badge means, and tells you how to report a plugin. The rules come from the plugins repository's CONTRIBUTING.md.

RulesCopy Anchor Link

1. Describe each tool clearly. Tools are how both the user and the agent use a plugin. Give each tool a clear Chinese title, and if you like a short summary (at most 80 characters) that tells users what it does. Write a description that tells the model when and how to use it. Validate the input; an MCP server does this with JSON Schema.
2. Declare each tool's effect honestly. A read tool must not change anything. A tool that changes state is write, one that spends money is money, and one that posts publicly is public. On an MCP server, set readOnlyHint: true only on read-only tools; the app treats every other tool as write. Students choose for each effect whether the agent may act directly or must ask first. A wrong effect therefore lets the agent skip a confirmation, and we treat it as a security bug.
3. Return data, not instructions. Tool results reach the model as data. Don't put prompts, hidden instructions or text like "ignore previous instructions" in results. If a tool returns text written by other people, such as forum posts, notices or emails, mark it with untrusted: true, and never pass that text on as if it were instructions.
4. Declare everything the plugin accesses. In PLUGIN.md, list every campus service (campus), public host (network) and host ability (abilities) the plugin needs, and give every tool its real effect. This list is the permission sheet that students accept. The app refuses anything that isn't declared.
5. Disclose cloud use. If the plugin uses PKU harness Cloud, the manifest's cloud block must say in plain words what data leaves the device. A plugin that collects data without saying so is removed.
6. Describe the plugin's reach accurately. scopes lists the hosts your server talks to, and requires lists what the phone must provide. Don't depend on a shell or a filesystem on the phone.
7. Credit protocol sources. If you port a campus protocol from pkucli, cite the source file.

Automatic checks and verificationCopy Anchor Link

Every listed plugin has passed the scanner (what it checks). Passing the scanner shows that the manifest is well-formed. It doesn't show that the plugin is safe.

The Verified badge means that a maintainer has also done the following:

• read the PLUGIN.md, its tool files and its Markdown instructions, and confirmed that the declarations match what the steps do. This covers campus services, hosts, abilities, effects and the cloud disclosure. The maintainer also checked that the instructions and results contain no text that reads like a prompt;
• confirmed that the public endpoint runs that source, or that the plugin is self-hosted;
• checked the rules above, especially the ones about credentials and prompt injection.

Marking a plugin verified (for maintainers)Copy Anchor Link

Verification is recorded per repository in data/sources.json:

{
  "sources": [
    { "repo": "alice/campus-tools", "addedAt": "2026-11-02", "verified": ["canteen-menu"] }
  ]
}

To verify a plugin, add its id to verified in a pull request. bun scripts/marketplace.ts check fails if a verified id no longer exists in the repository. Continuous integration (CI) runs this check on every change to data/ and once a week.

If a verified plugin later changes a lot, review it again. When in doubt, remove its id. Official plugins are verified through registry.json in pku-harness-plugins instead.

The optional sources[].path field limits a repository entry to one sub-folder. The submit flow sets it when someone submits a folder URL.

Reporting a pluginCopy Anchor Link

Open an issue in pkuinfo/pkuharness-website. Include the plugin's handle (owner/repo/id) and what you observed. For a security vulnerability in the app or in an official plugin, follow the security policy instead.