Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/davistroy/claude-marketplace/validate-plugin.evalgit clone --depth 1 https://github.com/davistroy/claude-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/davistroy/claude-marketplace/validate-plugin.eval)<a href="https://agentmods.dev/commands/davistroy/claude-marketplace/validate-plugin.eval"><img src="https://agentmods.dev/badge/commands/davistroy/claude-marketplace/validate-plugin.eval.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00679 |
| Opus 5 | $0.00000 | $0.00340 |
| Sonnet 5 | $0.00000 | $0.00136 |
| Haiku 4.5 | $0.00000 | $0.00068 |
Grade A, and why
validate-plugin.eval scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Eval: /validate-plugin
Purpose
Validates a plugin's directory structure, frontmatter fields, and content for consistency and correctness. Good output: a clear pass/fail result with specific findings for any structural or metadata issues.
Fixtures
None — operates on plugins in the marketplace repo.
Test Scenarios
S1: Validate personal-plugin (should pass)
Invocation: /validate-plugin personal-plugin
Must:
- Checks
plugins/personal-plugin/.claude-plugin/plugin.jsonexists and is valid JSON - Checks all
commands/*.mdfiles have valid frontmatter (descriptionfield, nonamefield) - Checks all
skills/*/SKILL.mdfiles havenameanddescriptionin frontmatter - Reports overall PASS or FAIL
- No false positives on a known-good plugin
Should:
- Reports count of commands and skills validated
- Lists any warnings (non-fatal issues)
Must NOT:
- Report FAIL for a plugin that is structurally correct
S2: Validate bpmn-plugin
Invocation: /validate-plugin bpmn-plugin
Must:
- Passes without false positives on the bpmn-plugin structure
S3: Validate --all plugins
Invocation: /validate-plugin --all
Must:
- Validates every plugin registered in marketplace.json
- Reports pass/fail for each
- Reports any naming collisions (two plugins with the same command name)
S4: Detect missing name in skill frontmatter
Setup: Temporarily create a test skill file with no name field:
mkdir -p plugins/personal-plugin/skills/testbad
echo "---
description: test skill without name
---
# Test" > plugins/personal-plugin/skills/testbad/SKILL.md
Invocation: /validate-plugin personal-plugin
Must:
- Reports FAIL with specific error: skill
testbadis missingnamefield - References the exact file path
Cleanup: Remove the test skill after eval.
S5: Detect flat skill file (wrong structure)
Setup: Create plugins/personal-plugin/skills/flatskill.md (flat, not nested).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 110 lines · 0 tokens per session scan A 9d784e1ba210
validate-plugin.eval is a command published in the GitHub repository davistroy/claude-marketplace (5 stars, last pushed 5d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 679 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.
analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.
constitution
Create or update the project constitution from interactive or provided principle inputs.
converge
Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.