plugin-audit

Plugin Audit

Role: orchestrator. Mechanical, deterministic structural compliance — pattern matching against the plugin contract. This is the generalized successor to dev-team's internal agent-audit, scoped to architectural decisions only.

Scope boundary

In scope (this skill)	Out of scope
Agent type appropriateness (markdown vs script)	Detection-logic quality (→ the plugin's own agent-eval)
Frontmatter compliance	Shipping hygiene / ${CLAUDE_PLUGIN_ROOT} ref resolution
Eval coverage presence	Shell portability (bash 3.2 / BSD / Git Bash)
Body line-count budgets	Catalog/version sync (→ release-please config)

Architecture only. Do not evaluate whether a detector is good — only whether the unit is the right type, well-formed, covered, and within budget.

Orchestrator constraints

1. Check structure, not semantics. Verify fields/sections/patterns exist and the type matches the job. Never grade detection rules.
2. Deterministic checks only. Every check is reproducible — does the field exist? Is the format correct? Is the body within budget?
3. Generalized. Resolve every path from the target plugin dir. Never assume plugins/dev-team, an agent-registry.md, or a .claude/docs/eval-system.md.
4. --fix applies minimal structural fixes (insert missing sections/fields from templates). Never rewrite existing content.
5. Be concise. Output the report table and action items only.

Step 1 — Resolve target plugin

Parse $ARGUMENTS:

• A directory path → audit that plugin.
• No path → if exactly one plugins/*/ exists, use it; if several, list them and ask which to audit; if the cwd is itself a plugin dir (.claude-plugin/plugin.json present), use it.
• --fix → after the report, apply fixes for FAIL/WARN items.

Let PLUGIN = the resolved dir, NAME = its .claude-plugin/plugin.json name. Eval fixtures are expected at the repo-root sibling evals/<NAME>/ (never shipped inside PLUGIN); accept evals/<NAME>/fixtures/ or flat evals/<NAME>/ layouts.