Tool Submission Guidelines

A clear, accurate description of what the tool does and does not do.

An explicit intended-use statement describing authorised use cases.

Licence information with attribution where required.

Version, supported platforms and installation instructions.

A reachable repository or documentation link where applicable.

Static analysis of the package or source.

Dependency and supply-chain review.

Malware scanning of submitted binaries.

Source availability verification.

Licence verification and developer verification.

Risk classification: low, moderate, high or restricted.

Undisclosed network egress or telemetry.

Obfuscated payloads without a documented reason.

Credential harvesting, phishing infrastructure or dropper behaviour.

Missing licence or unverifiable provenance.

Most reviews complete within five business days. High-risk classifications require a second reviewer and may take longer.