Add Pi Security plugin

[jorgeavaldez]

What this PR does

Adds the official Pi Security plugin to the Grok Build marketplace as a pinned remote source.

• Plugin name: pi-security
• Type: remote source with URL subpath
• Source URL + pinned SHA: https://github.com/pi-sloane/grok-plugin.git @ bbf2e4ea308fa66726104f01618cb0ae17a15648
• Source path: plugins/pi-security
• Homepage: https://www.pi.security/

The plugin provides one hosted HTTP MCP server and six skills for investigating findings, reviewing security posture, retrieving remediation guidance, starting security design reviews, importing Markdown reports, and applying secure-development guidance.

The source repository is also a standalone Pi Security plugin marketplace, so the catalog entry uses path: "plugins/pi-security" to select the installable plugin root.

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

pi-sloane is Pi Security's GitHub organization for Sloane and Grok integrations. The pinned plugin manifest identifies Pi Security, contact@pi.security, https://www.pi.security/, and the MIT license.

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated: MIT in the upstream repository and plugin manifest.

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why):
  • https://mcp.pi.security/mcp — Pi Security's hosted MCP endpoint for authenticated tenant queries and explicitly requested Pi actions.
• Credentials/permissions it requires (and why):
  • A Pi Security account with access to at least one tenant.
  • Browser-based OAuth/sign-in and the Pi tenant scopes granted through that flow.
  • No embedded API key, local service, or manually configured secret is required.

The plugin contains no lifecycle hooks, commands, agents, executable scripts, or installation scripts. Its six skills constrain access to named Pi tools, verify the connected tenant before tenant-data access, and require fresh explicit confirmation before uploads, design-review creation, package-plan generation, or feedback submission. Intended uploads send only user-provided content to Pi after that confirmation.

Validation

python3 scripts/generate-plugin-index.py
python3 scripts/validate-catalog.py
python3 scripts/generate-plugin-index.py --check

Results:

• Catalog validation passes.
• Generated plugin index is current.
• The index records version 0.2.0, one HTTP MCP server, and six skills.

Notes for reviewers

The source is pinned to the current public main commit. keywords and domains are limited to Pi Security's brand and owned domains to avoid generic CTA matches.