Proposal: add a fail-closed security-hooks plugin to the marketplace

まだ誰も着手していません。

Thanks for curating this marketplace — `aws-dev-toolkit` is a great build-side companion for startups on AWS.

One area a startup hits the moment it touches regulated data (fintech, health) is **guardrails on what the agent does**, not just what it can build. I've published an open-source (Apache-2.0) Claude Code plugin that fills that layer and would fit alongside `aws-dev-toolkit`:

**`fail-closed-security-hooks`** — five hooks wired through a fail-closed telemetry shim:
- **PII/secrets guard** — blocks AWS keys, private keys, JWTs, DB strings, credit cards, and national IDs across 7 jurisdictions (US/UK/JP/KR/SG/EU/AU) before they reach the model
- **Git policy guard** — remote allowlist, force-push prevention, protected branches, destructive-op blocking
- **Tamper-evident audit logger** — HMAC-SHA256 hash-chained JSONL; any edit/delete/reorder breaks the chain (verifier included); optional CloudWatch + SIEM dual-write
- **Token-budget circuit breaker** — per-session backstop for runaway agent loops
- **Fail-closed telemetry shim** — converts silent hook crashes/timeouts into explicit denials

Passes `claude plugin validate --strict`; ships a 76-assertion test suite. Repo: https://github.com/timwukp/claude-code-on-aws-bedrock-best-practices (plugin under `plugin/`).

**Question:** would a security/guardrails plugin be in scope for this marketplace? If so I'm happy to open a PR adding a `plugins/` entry and registering it in `marketplace.json` (source can reference my repo). Thanks!

まず、この security/guardrails plugin を marketplace が受け入れることを確認してください。この issue では対象範囲に含まれるかどうかを尋ねているためです。受け入れられる場合は、marketplace.json と既存の plugins/ エントリを調べ、その後 plugin/ 配下の plugin とその 76-assertion のテストスイートを確認してください。ソースが登録され、marketplace の検証にパスすれば完了です。

索引モデルが issue の本文から書いたものです。