How do I start an audit using Claude Code?

You can trigger the auditor by using phrases like 'audit plugin', 'security review', 'best practices check', or 'compliance check' followed by the name of the plugin you wish to scan.

Is the audit report easy to understand?

The audit generates a structured report with clear pass/fail status, quality scores for different categories (Security, Best Practices, Compliance), and prioritized recommendations ranging from Critical to Low severity.

Can this skill automatically fix the issues it finds?

Yes, it has auto-fix capabilities for certain issues including script permissions (chmod +x), JSON and Markdown formatting, and version synchronization across plugin files.

What specifically does the Plugin Auditor scan for in terms of security?

It scans for hardcoded secrets (API keys, passwords, tokens), AWS keys, private keys, dangerous shell commands like 'rm -rf /', command injection vectors, and suspicious non-HTTPS URLs.

Plugin Auditor

Name: Plugin Auditor
Author: jeremylongshore

byjeremylongshore

•

884

•

보안 및 테스팅

Audits Claude Code plugins for security vulnerabilities, repository compliance, and development best practices to ensure production readiness.

The Plugin Auditor is a comprehensive verification tool designed specifically for developers building Claude Code plugins. It automates the critical process of scanning for hardcoded secrets, dangerous shell commands, and structural inconsistencies while ensuring strict adherence to CLAUDE.md standards and marketplace requirements. By providing detailed, scored reports and auto-fix capabilities for common issues like file permissions and formatting, it significantly streamlines the path from local development to a secure, high-quality publication.

주요 기능

01Specific auditing for Model Context Protocol (MCP) plugin requirements and TypeScript configurations.

02884 GitHub stars

03Comprehensive quality scoring across security, performance, best practices, and UX.

04Automated security scanning for secrets, AWS keys, and command injection vectors.

05Structural validation against CLAUDE.md repository standards and plugin.json schemas.

06Auto-fix capabilities for script permissions, version syncing, and document formatting.

사용 사례

01Performing a pre-publication security review to prevent leaking API keys or private credentials.

02Generating quality scores and detailed recommendations during the code review process of new plugin features.

03Verifying marketplace compliance and directory structure before submitting a plugin to the community repository.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jeremylongshore/claude-code-plugins-plus-skills plugin-auditor

For use in Claude.ai and ChatGPT

Download Skill