anchor.diff:  ## Plugin sources
   
   If you refer to a plugin just by name (say `detect-clowns`), it defaults to
  -https://github.com/buildkite-plugins/detect-clowns-buildkite-plugin. If you used
  -`myorg/detect-clowns` it would be https://github.com/myorg/detect-clowns-buildkite-plugin.
  +https://github.com/buildkite-plugins/detect-clowns-buildkite-plugin. If you used `myorg/detect-clowns` it would refer to https://github.com/myorg/detect-clowns-buildkite-plugin.
   
   You can also use a fully qualified git repository name like `https://github.com/buildkite-plugins/detect-clowns-buildkite-plugin.git` or `git@github.com:foo/bar.git#v1.3`, which
   lets you refer to your own private git repositories. Branches, tags and commits
  
positive.code: 
  And then hook scripts under `hooks/`. A good example is the [docker plugin], which runs a command within a docker container.
  
  The pipeline invocation looks like:
  
  ```yml
  steps:
  
negative.code:   "${BUILDKITE_PLUGIN_DOCKER_IMAGE}" bash -c "${BUILDKITE_COMMAND}"
  ```
  
  The agent parses the plugin block and passes the parameters through to the script as environment variables in the form `BUILDKITE_PLUGIN_{NAME}_{KEY}`. If a list is provided then `BUILDKITE_PLUGIN_{NAME}_{KEY}_{IDX}`.
  
  Plugins are also able to offer `command` and `environment` hooks, which aren't allowed in per-project hooks. You can use these to change how plugins execute commands.
  
  ## Security and Reliability
  
  Plugins introduce a third-party dependency in your pipeline. They provide a way to introduce executable code into your pipeline beyond scripts in your repository and access to the `pipeline.yml`.
  
  Recommended security practices:
  
   * Always pin to a particular version of the plugin, e.g. `docker-compose#287293c4`. You can refer to any git ref. The agent will check this out the first time it encounters it and then re-use that checked out code.
  
   * Follow the [Unofficial Bash Strict Mode] and check your work with [shellcheck].
  
   * Apply special care to avoid executing arbitrary code passed in to plugins by config. As these are just environment variables, anything that can set environment variables can mess with plugin configuration.
  
  For particularly high-security setups, you can disable plugins selectively by removing them from the `BUILDKITE_PLUGINS` variable in your `environment` hook, or run agents with the `--no-plugins` flag.
  
  