What is plugin-release-auditor?

A release-configuration checker for a repository that contains coding-agent plugins. It compares each plugin's registration and version across the files used to publish releases.

Use it before opening a pull request that changes plugins to check release configuration, marketplace entries, manifest keys, version agreement, and applicable pull-request title rules.

It catches missing registrations or mismatched versions that could otherwise let tests pass while a plugin is silently left out of automated releases.

How racecraft-lab/racecraft-plugins-public configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to racecraft-lab/racecraft-plugins-public. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/racecraft-lab/racecraft-plugins-public/main/.claude/agents/plugin-release-auditor.md

Clone the repo

git clone --depth 1 https://github.com/racecraft-lab/racecraft-plugins-public

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/racecraft-lab/racecraft-plugins-public/plugin-release-auditor/github.svg)](https://agentmods.dev/agents/racecraft-lab/racecraft-plugins-public/plugin-release-auditor)

Your own site

<a href="https://agentmods.dev/agents/racecraft-lab/racecraft-plugins-public/plugin-release-auditor"><img src="https://agentmods.dev/badge/agents/racecraft-lab/racecraft-plugins-public/plugin-release-auditor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/racecraft-lab/racecraft-plugins-public/plugin-release-auditor"><img src="https://agentmods.dev/badge/agents/racecraft-lab/racecraft-plugins-public/plugin-release-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 97 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,099 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00097	$0.01099
Opus 5.5	$0.00039	$0.00440
Sonnet 5.5	$0.00019	$0.00220
Haiku 4.5	$0.00010	$0.00110

Measured 15d ago against content hash f3c862c66f72, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

plugin-release-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/plugin-release-auditor.md · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

plugin-release-auditor

You audit release-automation alignment in this Claude Code plugin marketplace. Run BEFORE the user opens a PR that touches plugins.

What you check

A plugin directory that is missing from release-please-config.json still passes CI but never gets a release entry. Make that gap loud.

Audit checklist

For every top-level directory at the repo root that contains a .claude-plugin/plugin.json:

Plugin → release-please-config.json — is there a packages.<plugin-name> entry?
Plugin → .release-please-manifest.json — is there a <plugin-name> key with a version string?
Plugin → marketplace registries — is the plugin listed in plugins[] of both .claude-plugin/marketplace.json and .agents/plugins/marketplace.json?
Version agreement — does every extra-files target listed for the package in release-please-config.json hold the version recorded for it in .release-please-manifest.json? Resolve a target path relative to the package directory unless it starts with /, which means the repository root: for speckit-pro, .codex-plugin/plugin.json is speckit-pro/.codex-plugin/plugin.json and /.agents/plugins/marketplace.json is at the root. Parse each file with Python's standard-library json and evaluate its jsonpath by hand. The .claude-plugin manifests carry no version field. python3 scripts/refresh-release-artifacts.py --check reports registry drift.
Manifest key parity — does every key in .release-please-manifest.json have a corresponding entry in release-please-config.json packages? (and vice-versa)

If the current branch is a PR branch, also: 6. PR title — fetch the open PR via gh pr view --json title and validate it with the release-readiness gate that the validate-pr-title job runs: python3 scripts/check-pr-title.py '<title>'. The gate requires <type>(<lowercase-scope>): <description> with type feat, fix, chore, docs, refactor, or test.

How to do it

Read the full file on GitHub · 83 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

15d ago Changed f3c862c66f72
26d ago Changed a4c2ebf70e7a
1mo ago Changed · -3 lines 941dd80a9c13
1mo ago First seen · 86 lines · 97 tokens per session scan A 7eb945f5c17e

Subscribe to this mod's changes

plugin-release-auditor is an agent published in the GitHub repository racecraft-lab/racecraft-plugins-public (5 stars, last pushed yesterday), licensed MIT. It adds 97 tokens to every session and 1,099 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Git and workflow Releases claude-plugins mcp skills spec-driven-development

vios-release-note

Generate a complete VIOS multi-arch release note for a given build drop version. Fetches container images from GitHub compose.env files, commit titles from GitHub between the previous release tag and HEAD, Jira VST tickets, NVBugs entries, Slack channel evidence, and Outlook email evidence, then renders a formatted…

NVIDIA-AI-Blueprints/video-search-and-summarization · 285 tokens

git

Specialized git operations — semantic commits, PR descriptions, branch naming, changelog generation, release tagging. Convention-aware utility replacing ad-hoc git commands.

Rune-kit/rune · 33 tokens

pr-ghostwriter

Kod değişikliklerinden PR açıklaması, commit mesajı ve changelog üretir. Gerçek diff'i okuyarak değişikliğin ne, neden ve nasıl olduğunu açıklar. Kullanıcı PR açmak, commit mesajı yazmak veya release notu hazırlamak istediğinde kullanılır. Jenerik açıklama üretmez — her zaman gerçek değişikliğe özgü yazar.

komunite/kalfa · 81 tokens

racecraft-plugins-public: Agent for Claude Code