claude-plugins-validation

Add a new component (skill / agent / command / hook / mcp) to an existing plugin. Use when scaffolding a single component into a plugin without re-running the generator. Used dynamically via the-skills-menu (TRDD-478d9687).

Add plugin dependencies to a target plugin (explicit --add specs or --from copy from another plugin's plugin.json). Use when adding/copying plugin.json::dependencies entries with atomic rollback on regression. Used dynamically via the-skills-menu (TRDD-478d9687).

Add a new hook entry to hooks/hooks.json in an existing plugin (idempotent — skips duplicate entries; cross-platform-aware). Use when adding a new event-handler that must run identically on Linux/macOS/Windows. Used dynamically via the-skills-menu (TRDD-478d9687).

Bump plugin version and run the full publish pipeline (plugin.json, pyproject.toml, README badge, CHANGELOG, push, release). Use when bumping version + publishing the current plugin via publish.py. Used dynamically via the-skills-menu (TRDD-478d9687).

Routes the /cpv-main-menu Stop-hook menu via scripts/print_menu.py + claude-menu-system. Used dynamically via the-skills-menu (TRDD-478d9687) — used by the /cpv-main-menu flow. Use when navigating CPV's many commands via a single entry point.

Deterministic codemod CLI — bulk-fix backtick-path to markdown-link, add TOC stubs, dedup blank lines, and other mechanical text transforms (issue 17). Zero LLM cost. Use when mechanical fixes outnumber semantic ones. Used dynamically via the-skills-menu (TRDD-478d9687).

Link an existing plugin to an existing marketplace (local or GitHub source). Use when appending an existing plugin to a marketplace.json. Used dynamically via the-skills-menu (TRDD-478d9687).

Pack a folder of standalone components (skill/agent/command/hook/mcp/lsp/monitor/output-style) into a new installable plugin. Use when bundling loose components into a single publishable plugin. Used dynamically via the-skills-menu (TRDD-478d9687).

Refresh AUTO-* marker blocks in a plugin's README (auto-detected components table). Use when the README's components list has drifted from the filesystem. Used dynamically via the-skills-menu (TRDD-478d9687).

Register a new MCP server in an existing plugin's .mcp.json (stdio default; supports HTTP transport via --http-url; cross-platform command via Python/Node). Use when adding a new MCP server entry. Used dynamically via the-skills-menu (TRDD-478d9687).

Scaffold a new agent in an existing plugin (creates agents/{NAME}.md with valid frontmatter that passes validate_plugin out of the box). Use when adding a single agent to an existing plugin. Used dynamically via the-skills-menu (TRDD-478d9687).

Scaffold a new slash command in an existing plugin (creates commands/{NAME}.md with valid frontmatter that passes validate_plugin out of the box). Use when adding a single slash command to an existing plugin. Used dynamically via the-skills-menu (TRDD-478d9687).

Scaffold a new skill in an existing plugin (creates skills/{NAME}/SKILL.md with valid frontmatter that passes validate_plugin out of the box). Use when adding a single skill to an existing plugin. Used dynamically via the-skills-menu (TRDD-478d9687).

Show the CPV management tools version. Use when reporting the installed CPV CLI version. Used dynamically via the-skills-menu (TRDD-478d9687).

Move dev-only artefacts (default tests/) from a plugin's MAIN repo into a per-plugin git submodule. Use when shrinking end-user installs via shallow-clone trick. Used dynamically via the-skills-menu (TRDD-478d9687).

Agent-facing à-la-carte menu of every claude-plugins-validation (CPV) skill, agent, and script: classifies a plugin-quality request — validate, security-scan, fix, cache-optimize, create, publish, marketplace, manage, semantic-grade — and routes it to the right tool. Use when a request mentions CPV, the CPV skills menu, or validating / fixing / publishing / scanning / cache-optimizing a plugin and the exact tool is unchosen. Trigger with 'read the CPV skills menu', 'use CPV to <task>', or Skill(claude-plugins-validation:the-skills-menu). Also the runtime catalog CPV agents consult (TRDD-478d9687).

Validate plugins / projects against Anthropic's prompt-cache invalidation patterns (CA-01..CA-07). Use when auditing for cache regressions or fixing CA-01..CA-07 findings. Used dynamically via the-skills-menu (TRDD-478d9687).

Validates Claude Code plugins for structural correctness, quality, and marketplace readiness. Use when validating, fixing, migrating, upgrading, or scaffolding a plugin. Used dynamically via the-skills-menu (TRDD-478d9687). Embeds canonical plugins-reference.md.

Standard files, CI/CD, hooks, and release pipeline for Emasoft Claude Code plugins. Use when creating or auditing plugin repos. Used dynamically via the-skills-menu — any CPV agent can invoke at runtime (TRDD-478d9687).

Maps CPV validation errors to mechanical per-error fix guides. Use when looking up remediation steps for CRITICAL/MAJOR/MINOR/NIT findings. Architectural migrations are handled by migrate-marketplace-architecture. Used dynamically via the-skills-menu (TRDD-478d9687).

Audit and fix plugin/marketplace repos to match CPV standards. Use when standardizing or auditing repo structure. Used dynamically via the-skills-menu (TRDD-478d9687).

Create Claude Code plugin or marketplace repos with full CI/CD. Use when scaffolding. Used via the-skills-menu.

Create and configure Claude Code plugin GitHub repositories with CI/CD, hooks, and marketplace notification. Use when setting up a new plugin repo. Used dynamically via the-skills-menu (TRDD-478d9687).

Schema reference for the /cpv-batch-fix parallel-shard fix protocol — manifest format, status format, planner/aggregator contracts. Use when implementing a new consumer of the batch protocol or extending the planner/aggregator. Used dynamically via the-skills-menu (TRDD-478d9687) — any CPV agent can invoke.

Advisory diagnostic that detects when a Claude Code plugin ships files not needed at runtime — build-only source, dependency trees, dev-only dirs, regenerable build caches — and recommends the existing CPV lean-separation. Use when the user asks 'is my plugin too big', 'what files ship', 'reduce install size', 'lean the plugin', 'diagnose plugin architecture', 'unneeded files shipped', or wants to know which paths bloat an install. Read-only: it diagnoses and points at the separate strip-dev / ${CLAUDE_PLUGIN_DATA} step; it NEVER moves or deletes anything. Used dynamically via the-skills-menu; loaded by plugin-diagnoser agent.

Transformation catalog for converting flagged execution-class security findings into provably-inert data — so a plugin passes CPV's security gate by neutralizing the code's executable shape, never by suppressing a rule or relaxing --strict. Maps each threat shape (live os.system / subprocess(shell=True), pipe-to-shell install docs, eval/exec of a string, backtick command substitution, hardcoded bearer tokens in docs, detection-pattern signatures) to a before/after rewrite plus the inert-proof the scanner recognizes. Use when a plugin's security scan reports execution-class findings that must be cleared by making the code provably inert rather than by suppressing rules. Used dynamically via the-skills-menu by the plugin-devitalizer agent.

Catalog for fixing security-scan LEAK and MISSING-SAFEGUARD findings without loss of functionality — redacting secrets (and runtime-reading the needed ones from env / GitHub vars / OS keychain), and implementing missing safeguards: safe config parsing, input sanitization, correct launch / deploy / untrusted-input parameters, safe file loading, and a by-code-only prompt-injection pre-scan that runs before any agent reads untrusted content. Maps each finding to a before/after rewrite plus a no-functionality-loss note and a re-scan. Use when a security scan reports leaked secrets or missing safeguards that must be redacted or hardened rather than suppressed. Used dynamically via the-skills-menu by the plugin-leaks-preventer agent.

Fleet-wide read-only cache audit. Accepts local paths, GitHub URLs, marketplaces, lists, and @listfile shapes. One cache-optimizer-agent per plugin runs Phase 1 only — detects CA-01..CA-07 prompt-cache invalidation patterns, no fixes. Use when surveying cache-invalidation findings across many plugins without applying changes. Trigger with /cpv-batch-caching-audit.

Fleet-wide parallel cache fix. Accepts local paths, GitHub URLs, marketplaces, lists, and @listfile shapes. One cache-optimizer-agent per plugin runs Phase 1 audit + Phase 2 fix + Phase 3 re-validate; Phase 4 broader refactor SKIPPED (run the cache-optimizer-agent on a single plugin to opt in). Use when applying CA-01..CA-07 fixes across many plugins. Trigger with /cpv-batch-caching-optimize.

Apply scope-aware doctor fixes across a fleet of project folders. One cpv-doctor-agent per project in batch_scope_fix mode handles the requested scope (user / project / local / full). Auto-applies NIT and CRITICAL fixes; reports MAJOR / MINOR fixes in pending_fixes[] for user approval. LOCAL paths only. Use when applying mechanical doctor fixes across many project folders. Trigger with /cpv-batch-scope-fix.

Fleet-wide parallel security audit. Accepts local paths, GitHub URLs, marketplaces, lists, and @listfile shapes. One plugin-validator per plugin runs ONLY validate_security (5 external scanners + AI/security rules). Use when checking supply-chain risk across many plugins. Trigger with /cpv-batch-security-audit or 'security-audit every plugin in X'.

Same-turn parallel validate-and-fix across a marketplace / list / single plugin. Each plugin-fixer reads every source file ONCE — scans + verifies false positives (via v2.100.x AST/JSON/markdown classifier + llm-externalizer with file-range syntax) + fixes inline. ~3× cheaper per plugin than running cpv-batch-validate + cpv-batch-fix separately. Use when applying validation fixes across many plugins and you trust the FP classifier chain. Trigger with /cpv-batch-validate-and-fix.

Maps marketplace validation errors to fix reference files. Used dynamically via the-skills-menu — any CPV agent can invoke at runtime (TRDD-478d9687). Use when a marketplace validation report has CRITICAL/MAJOR/MINOR/NIT findings from validate_marketplace.py or validate_marketplace_pipeline.py.

Proactive marketplace.json authoring contract for plugin-touching agents. Use when drafting, modifying, or migrating any marketplace.json. Used dynamically via the-skills-menu (TRDD-478d9687).

Convert a non-CPV marketplace between Layout A (hub-and-spoke), Layout B (nested-with-discipline), and Layout C (marketplace-in-plugin self-referential). Use when migrating marketplace architecture. Used dynamically via the-skills-menu (TRDD-478d9687).

Manage Claude Code plugins: install, validate, audit, enable, disable, search, doctor. Use when managing plugin lifecycle. Used dynamically via the-skills-menu (TRDD-478d9687).

Deep AI semantic validation for skills/agents. Use when checking triggering, clarity, examples. Used dynamically via the-skills-menu (TRDD-478d9687). 10x token cost.

Use when creating a plugin marketplace or linking plugins to one. Used dynamically via the-skills-menu (TRDD-478d9687).

Use when configuring a plugin to notify its marketplace after each release so Claude Code can auto-update users. Universal CI recipe for any plugin/marketplace pair. Used dynamically via the-skills-menu (TRDD-478d9687).

Validate skills using 190+ rules from AgentSkills OpenSpec, Nixtla, and Meta-Skill frameworks. Use when validating SKILL.md files or auditing skill quality. Used dynamically via the-skills-menu (TRDD-478d9687).