cpv-validate-plugin-folder

cpv-validate-plugin-folder

Read-only. Runs one script and reports what it printed.

Overview

One command, full coverage, for one folder shape at a time. The skill composes CPV's existing validators — plugin --strict, marketplace, skill --strict, and the full security scan — behind a single entry point (cpv_validate_plugin_folder.py) so a caller never has to know in advance which validator applies. It never implements a rule of its own: every finding traces back to an existing CPV validator, and the skill's only job is detecting the folder's shape, dispatching the right validator combination, merging the results, and reporting a single severity table with the report path and the fixer to run next.

Prerequisites

• A Python 3 interpreter on PATH (the script is invoked as python3 "${CLAUDE_PLUGIN_ROOT}/scripts/cpv_validate_plugin_folder.py").
• git on PATH when the target is a remote URL or an owner/repo slug — the script clones it into a temp sandbox before scanning.
• No other setup: the script requires no network access for a local path, no installation step, and never runs the plugin/skill/repo it scans.

Instructions

1. Run exactly this, substituting the user's argument when they gave one and omitting it entirely when they did not — the script resolves the default itself, so do not guess a path on its behalf:

   python3 "${CLAUDE_PLUGIN_ROOT}/scripts/cpv_validate_plugin_folder.py" [folder-path-or-repo-url]
   

2. Relay the script's output verbatim in substance: the severity table, the report path, and the suggested fixer for each failing scan.

3. Stop there. Do not summarise findings away, do not re-run individual validators, and do not fix anything — this skill is the read-only half. Fixing is a separate, explicit user decision, which is why the script names the fixer instead of dispatching it.

The skill is done when the table, the report path and any fixer suggestions have been relayed; a non-zero exit is a verdict to report, not an error to retry.