What security vulnerabilities does the Plugin Auditor check for?

It scans for hardcoded secrets (API keys, passwords), AWS keys, private keys, dangerous shell commands like 'eval' or 'rm -rf /', command injection vectors, and non-HTTPS URLs.

Does it work for Model Context Protocol (MCP) plugins?

Yes, it includes specific checks for MCP-based plugins, including package.json dependencies, TypeScript configuration, and build script verification.

How do I trigger a plugin audit?

You can activate the skill by asking Claude to 'audit plugin', 'perform security review', or 'check best practices' while working on a plugin directory.

Does it check marketplace compatibility?

Yes, it verifies plugin.json schema validity, marketplace catalog entries, category assignment, and version consistency to ensure the plugin is ready for distribution.

Can this skill fix issues automatically?

Yes, the auditor can automatically fix common issues such as incorrect script permissions, JSON formatting, markdown styling, and version synchronization across files.

Claude Plugin Auditor

Name: Claude Plugin Auditor
Author: intent-solutions-io

byintent-solutions-io

0•

Security & Testing

Automates security, compliance, and best practice audits for Claude Code plugins to ensure production-readiness and marketplace standards.

The Plugin Auditor is a comprehensive diagnostic tool designed to evaluate Claude Code plugins against strict security and quality standards. It automatically scans for hardcoded secrets, dangerous commands, and CLAUDE.md repository compliance, while also verifying marketplace metadata and documentation quality. By providing a detailed quality score and automated fix capabilities for common issues like file permissions and formatting, it streamlines the development process for contributors to the Claude plugin ecosystem and ensures high-quality deployments.

Key Features

01Comprehensive quality scoring across security, best practices, and documentation

02Auto-fix capabilities for script permissions, JSON formatting, and version syncing

03Validation of plugin structure and CLAUDE.md repository standard compliance

040 GitHub stars

05Marketplace readiness assessment including catalog entry and schema verification

06Automated security scanning for hardcoded secrets, AWS keys, and dangerous shell commands

Use Cases

01Ensuring new plugin contributions adhere to organizational repository standards and CLAUDE.md rules

02Identifying and fixing code quality issues such as console.log statements or missing execute permissions

03Performing a final security review before publishing a plugin to the community marketplace

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add intent-solutions-io/plugins-nixtla plugin-auditor

For use in Claude.ai and ChatGPT

Download Skill