Skill

plugin-auditor

Audits Claude Code plugins for security vulnerabilities, best practices, CLAUDE.md compliance, marketplace readiness, git hygiene, and performance issues. Use for plugin security scans or quality reviews.

Bash

Git

security

code-quality

From jeremy-plugin-tool

Install

Run in your terminal

npx claudepluginhub jeremylongshore/claude-code-plugins-plus-skills

Tool Access

This skill is limited to using the following tools:

ReadGrepBash(cmd:*)

Supporting Assets

View in Repository

assets/README.md

references/ARD.md

references/PRD.md

references/README.md

references/audit-categories.md

references/audit-process.md

references/audit-report-format.md

references/errors.md

references/examples.md

scripts/README.md

Skill Content

Similar Skills

agent-harness-construction

Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.

everything-claude-code

139.9k

agent-payment-x402

Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.

everything-claude-code

139.9k

agent-eval

Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.

everything-claude-code

139.9k

Stats

Parent Repo Stars1845

Parent Repo Forks247

Last CommitApr 3, 2026

Actions

View Source View Plugin View on GitHub View README

Plugin Auditor

Overview

Audits Claude Code plugins for security vulnerabilities, best practices compliance, CLAUDE.md standards adherence, and marketplace readiness. Produces a scored audit report covering eight categories: security, best practices, CLAUDE.md compliance, marketplace compliance, git hygiene, MCP-specific checks, performance, and UX.

Prerequisites

Read access to the target plugin directory and repository-level .claude-plugin/marketplace.extended.json
jq installed for JSON schema validation
grep and find available on PATH for pattern scanning
Familiarity with the plugin structure defined in CLAUDE.md (.claude-plugin/plugin.json, README.md, LICENSE, component directories)

Instructions

Identify the target plugin path (e.g., plugins/security/plugin-name/). Confirm the directory exists and contains .claude-plugin/plugin.json.
Run a security scan across all plugin files (see ${CLAUDE_SKILL_DIR}/references/audit-categories.md for full pattern list):
- Search for hardcoded secrets, API keys, AWS access keys (AKIA...), and private key headers.
- Detect dangerous commands (rm -rf /, eval(), exec()) and command injection vectors.
- Flag suspicious URLs (non-HTTPS, raw IP addresses) and obfuscated code (base64 decode, hex encoding).
Validate plugin structure and best practices (see ${CLAUDE_SKILL_DIR}/references/audit-process.md):
- Confirm required files exist: plugin.json, README.md, LICENSE.
- Verify semantic versioning format in plugin.json.
- Check that all .sh scripts have execute permissions.
- Scan for TODO/TODO comments without linked issues and console.log() in production code.
Check CLAUDE.md compliance:
- Verify the plugin follows the directory structure specified in the repository CLAUDE.md.
- Confirm plugin.json contains only allowed fields (name, version, description, author, repository, homepage, license, keywords).
- Validate that hooks use ${CLAUDE_PLUGIN_ROOT} instead of hardcoded paths.
Verify marketplace compliance:
- Confirm the plugin has an entry in marketplace.extended.json with matching name, version, category, and source path.
- Check for duplicate plugin names in the catalog.
Assess git hygiene: no committed node_modules/, .env files, large binaries, or merge conflict markers.
For MCP plugins: validate package.json dependencies, TypeScript configuration, dist/ in .gitignore, and build scripts.
Generate a scored audit report following the format in ${CLAUDE_SKILL_DIR}/references/audit-report-format.md, with per-category scores out of 10 and an overall quality rating.

Output

A structured audit report containing:

Plugin identification (name, version, category, audit date)
Per-category results: passed checks, failed checks with fix commands, warnings with recommendations
Numeric quality scores: Security (x/10), Best Practices (x/10), Compliance (x/10), Documentation (x/10)
Overall score and rating (Excellent / Good / Needs Work / Failed)
Prioritized recommendations list with estimated fix time

Error Handling

Error	Cause	Solution
Plugin directory not found	Incorrect path or plugin does not exist	Verify the path matches `plugins/[category]/[name]/` structure
`plugin.json` missing or invalid	File absent or malformed JSON	Create from template or fix JSON syntax with `jq empty .claude-plugin/plugin.json`
Marketplace entry missing	Plugin not yet added to catalog	Add entry to `marketplace.extended.json` and run `pnpm run sync-marketplace`
Version mismatch detected	`plugin.json` and `marketplace.extended.json` carry different versions	Update the stale file to match the authoritative version
Permission denied during scan	Restricted file access	Request read permissions on the plugin directory tree

Examples

Full audit before publishing: Trigger: "Audit the security-scanner plugin." Process: Run all eight audit categories against plugins/security/security-scanner/. Generate a comprehensive report with per-category scores. Report overall rating and prioritized fix list (see ${CLAUDE_SKILL_DIR}/references/examples.md).

Publish readiness check: Trigger: "Is this plugin safe to publish?" Process: Prioritize security audit (critical), then marketplace compliance and quality scoring. Produce a publish readiness assessment with pass/fail verdict.

Featured status review: Trigger: "Quality review before featured status." Process: Run full audit with elevated quality thresholds. Apply featured plugin requirements (higher documentation and test coverage standards). Recommend approve or reject.

Resources

${CLAUDE_SKILL_DIR}/references/audit-categories.md -- all eight audit categories with specific checks
${CLAUDE_SKILL_DIR}/references/audit-process.md -- step-by-step audit execution procedures
${CLAUDE_SKILL_DIR}/references/audit-report-format.md -- report template with scoring rubric
${CLAUDE_SKILL_DIR}/references/examples.md -- audit scenario walkthroughs
${CLAUDE_SKILL_DIR}/references/errors.md -- error handling patterns