plugin-auditor

name	plugin-auditor
description	Audit automatically audits AI assistant code plugins for security vulnerabilities, best practices, AI assistant.md compliance, and quality standards when user mentions audit plugin, security review, or best practices check. specific to AI assistant-code-plugins repositor... Use when assessing security or running audits. Trigger with phrases like 'security scan', 'audit', or 'vulnerability'.
allowed-tools	Read, Grep, Bash(cmd:*)
version	2.19.0
author	Jeremy Longshore <[e-mail]>
license	MIT
tags	["example","security","compliance","audit"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Plugin Auditor

Overview

Audits Claude Code plugins for security vulnerabilities, best practices compliance, CLAUDE.md standards adherence, and marketplace readiness. Produces a scored audit report covering eight categories: security, best practices, CLAUDE.md compliance, marketplace compliance, git hygiene, MCP-specific checks, performance, and UX.

Prerequisites

• Read access to the target plugin directory and repository-level .claude-plugin/marketplace.extended.json
• jq installed for JSON schema validation
• grep and find available on PATH for pattern scanning
• Familiarity with the plugin structure defined in CLAUDE.md (.claude-plugin/plugin.json, README.md, LICENSE, component directories)

Instructions

1. Identify the target plugin path (e.g., plugins/security/plugin-name/). Confirm the directory exists and contains .claude-plugin/plugin.json.
2. Run a security scan across all plugin files (see ${CLAUDE_SKILL_DIR}/references/audit-categories.md for full pattern list):
   • Search for hardcoded secrets, API keys, AWS access keys (AKIA...), and private key headers.
   • Detect dangerous commands (rm -rf /, eval(), exec()) and command injection vectors.
   • Flag suspicious URLs (non-HTTPS, raw IP addresses) and obfuscated code (base64 decode, hex encoding).
3. Validate plugin structure and best practices (see ${CLAUDE_SKILL_DIR}/references/audit-process.md):
   • Confirm required files exist: plugin.json, README.md, LICENSE.
   • Verify semantic versioning format in plugin.json.
   • Check that all .sh scripts have execute permissions.
   • Scan for TODO/TODO comments without linked issues and console.log() in production code.
4. Check CLAUDE.md compliance:
   • Verify the plugin follows the directory structure specified in the repository CLAUDE.md.
   • Confirm plugin.json contains only allowed fields (name, version, , , , , , ).