Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add iPlug3/audio-plugin-dev-skills --skill validate-pluginvalgit clone --depth 1 https://github.com/iPlug3/audio-plugin-dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iplug3/audio-plugin-dev-skills/validate-pluginval)<a href="https://agentmods.dev/skills/iplug3/audio-plugin-dev-skills/validate-pluginval"><img src="https://agentmods.dev/badge/skills/iplug3/audio-plugin-dev-skills/validate-pluginval/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/iplug3/audio-plugin-dev-skills/validate-pluginval"><img src="https://agentmods.dev/badge/skills/iplug3/audio-plugin-dev-skills/validate-pluginval.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01529 |
| Opus 5.5 | $0.00030 | $0.00612 |
| Sonnet 5.5 | $0.00015 | $0.00306 |
| Haiku 4.5 | $0.00007 | $0.00153 |
Grade A, and why
validate-pluginval scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 195 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pluginval
Cross-platform validator for VST3 and AudioUnit plugins.
Plugin Install Locations
pluginval accepts a direct path. These are the standard install locations by format.
AudioUnit (.component) — macOS only:
| Location | Scope |
|---|---|
~/Library/Audio/Plug-Ins/Components/ |
Current user only |
/Library/Audio/Plug-Ins/Components/ |
All users |
VST3 (.vst3):
| Platform | User Location | System Location |
|---|---|---|
| macOS | ~/Library/Audio/Plug-Ins/VST3/ |
/Library/Audio/Plug-Ins/VST3/ |
| Windows | %LOCALAPPDATA%\Programs\Common\VST3\ |
C:\Program Files\Common Files\VST3\ |
| Linux | ~/.vst3/ |
/usr/lib/vst3/ or /usr/local/lib/vst3/ |
Instructions
- Install pluginval (see Installation below)
- Locate the built plugin (
.vst3or.component) in your build output directory or one of the standard locations above - Run at strictness level 5 (recommended minimum):
- macOS:
/Applications/pluginval.app/Contents/MacOS/pluginval --strictness-level 5 /path/to/plugin - Windows:
pluginval.exe --strictness-level 5 "C:\path\to\plugin.vst3" - Linux:
pluginval --strictness-level 5 /path/to/plugin.vst3
- macOS:
- If it crashes on a multi-bus VST3, use
validate-vst3instead - For CI, add
--skip-gui-testsfor headless environments
Installation
Download from GitHub Releases.
| Platform | Setup |
|---|---|
| macOS | Extract and move pluginval.app to /Applications/ |
| Windows | Extract pluginval.exe and add to PATH or use full path |
| Linux | Extract pluginval binary, chmod +x, place in /usr/local/bin/ |
Verify installation:
# macOS
/Applications/pluginval.app/Contents/MacOS/pluginval --help
# Windows
pluginval.exe --help
# Linux
pluginval --help
Basic Usage
# macOS
/Applications/pluginval.app/Contents/MacOS/pluginval --strictness-level 5 /path/to/plugin
# Windows
pluginval.exe --strictness-level 5 "C:\path\to\plugin.vst3"
# Linux
pluginval --strictness-level 5 /path/to/plugin.vst3
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 195 lines · 75 tokens per session scan A ed90f3b201f4
validate-pluginval is a skill published in the GitHub repository iPlug3/audio-plugin-dev-skills (96 stars, last pushed 8mo ago), licensed MIT. It adds 75 tokens to every session and 1,529 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
create-custom-grader
Use when converting an existing benchmark, rubric, verifier, task YAML/JSON, or domain check into SkillEvaluator BYOG/BYOT custom evaluation.
lime-quality-workflow
A set of validation rules for the Lime project. It selects appropriate checks for changes involving the graphical interface, commands or bridges, configuration, versions, and pull-request readiness.
archetype-lint
This skill should be used when the user asks to "lint an archetype", "validate an archetype", "check archetype compliance", "check archetype rules compliance", or "run archetype rules". Applies 24 normative lint rules with ERROR/WARNING/INFO severity. Supports STRICT and PERMISSIVE modes. Reports violations only — it…
random-user-post-batch
Returns multiple randomly generated fake user profiles in a single request. Each call consumes count units of quota. Maximum 50 users per request.
random-user-get-random-user
Returns a randomly generated fake user profile.
testing
Testing conventions and patterns. Use when writing or modifying tests, creating mocks, or using object mothers.