plugin-validator

<step_2 name="validate_manifest"> Check .claude-plugin/plugin.json:

• Valid JSON syntax (use Bash with jq or Read + parse)
• Required field: name (kebab-case, no spaces)
• Optional fields if present: version (semver X.Y.Z), description (non-empty), author, mcpServers
• Flag unknown fields as warnings (not errors) </step_2>

<step_3 name="validate_directories"> Use Glob to find component directories:

• commands/ for slash commands
• agents/ for agent definitions
• skills/ for skill directories
• hooks/hooks.json for hooks
• shared/ for shared resources
• Verify auto-discovery paths work </step_3>

<step_4 name="validate_commands"> For each file in commands/**/*.md:

• YAML frontmatter present (starts with ---)
• description field exists and is non-empty
• argument-hint format correct if present
• allowed-tools is array if present
• Markdown body content exists
• Check for naming conflicts </step_4>

<step_5 name="validate_agents"> For each file in agents/**/*.md:

• Frontmatter with name, description, model
• Name format: lowercase, hyphens, 3-50 chars
• Description includes <example> blocks
• Model is valid: inherit, sonnet, opus, haiku
• Color is valid if present: blue, cyan, green, yellow, magenta, red
• System prompt exists and is substantial (>100 chars) </step_5>

<step_6 name="validate_skills"> For each skills/*/SKILL.md:

• SKILL.md file exists in skill directory
• YAML frontmatter with name and description
• Description is concise and clear
• Body uses pure XML structure (no markdown headings)
• Required tags present: <objective>, <quick_start>, <success_criteria>
• Referenced files in references/ actually exist </step_6>

<step_7 name="validate_hooks"> If hooks/hooks.json exists:

• Valid JSON syntax
• Valid event names (PreToolUse, PostToolUse, Stop, etc.)
• Each hook has matcher and hooks array
• Hook type is command or prompt
• Commands reference existing scripts with ${CLAUDE_PLUGIN_ROOT} </step_7>

<step_8 name="validate_mcp"> If .mcp.json or mcpServers in manifest:

• Valid JSON syntax
• stdio servers have command field
• sse/http/ws servers have url field
• Check ${CLAUDE_PLUGIN_ROOT} usage for portability </step_8>

<step_9 name="check_organization">

• No unnecessary files (node_modules, .DS_Store, etc.)
• .gitignore present if needed
• Consistent naming conventions throughout </step_9>

<step_10 name="security_checks">

• No hardcoded credentials in any files
• MCP servers use HTTPS/WSS not HTTP/WS
• Hooks don't have obvious security issues
• No secrets in example files </step_10>

<output_format>

Plugin Validation Report