Agent skill · security · jeremylongshore
plugin-auditor
Audit automatically audits AI assistant code plugins for security vulnerabilities,
Why this skill is useful
Adds a comprehensive auditing script that checks for security vulnerabilities and compliance specific to AI assistant plugins, which the AI cannot generate on its own.
What it needs
Requires grep, jq installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Plugin Auditor Overview Audits Claude Code plugins for security vulnerabilities, best practices compliance, CLAUDE.md standards adherence, and marketplace readiness. Produces a scored audit report covering eight categories: security, best practices, CLAUDE.md compliance, marketplace compliance, git hygiene, MCP-specific checks, performance, and UX. Prerequisites Read access to the target plugin directory and repository-level .claude-plugin/marketplace.extended.json jq installed for JSON schema validation grep and find available on PATH for pattern scanning Familiarity with the plugin structure defined in CLAUDE.md (.claude-plugin/plugin.json, README.md, LICENSE, component directories) Instructions 1. Identify the target plugin path (e.g., plugins/security/plugin-name/). Confirm the directory exists and contains .claude-plugin/plugin.json. 2. Run a security scan across all plugin files (see ${CLAUDESKILLDIR}/references/audit-categories.md for full pattern list): Search for hardcoded secrets, API keys, AWS access keys (AKIA...), and private key headers. Detect dangerous commands (rm -rf /, eval(), exec()) and command injection vectors. Flag suspicious URLs (non-HTTPS, raw IP addresses) and obfuscated code (base64 decode, hex encoding). 3. Validate plugin structure and best practices (see ${CLAUDESKILLDIR}/references/audit-process.md): Confirm required files exist: plugin.json, README.md, LICENSE. Verify semantic versioning format in plugin.json. Check that all .sh scripts have execute permissions. Scan for TODO/TODO comments without linked issues and console.log() in production code. 4. Check CLAUDE.md compliance: Verify the plugin follows the directory structure specified in the repository CLAUDE.md. Confirm plugin.json contains only allowed fields (name, version, description, author, repository, homepage, license, keywords). Validate that hooks use ${CLAUDEPLUGINROOT} instead of hardcoded paths. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/plugin-auditor