Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add neurawork-git/n8n-autopilot --skill plugin-testinggit clone --depth 1 https://github.com/neurawork-git/n8n-autopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/neurawork-git/n8n-autopilot/plugin-testing)<a href="https://agentmods.dev/skills/neurawork-git/n8n-autopilot/plugin-testing"><img src="https://agentmods.dev/badge/skills/neurawork-git/n8n-autopilot/plugin-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/neurawork-git/n8n-autopilot/plugin-testing"><img src="https://agentmods.dev/badge/skills/neurawork-git/n8n-autopilot/plugin-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.01428 |
| Opus 5.5 | $0.00037 | $0.00571 |
| Sonnet 5.5 | $0.00019 | $0.00286 |
| Haiku 4.5 | $0.00009 | $0.00143 |
Grade A, and why
plugin-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin Testing — push to repo, install from there, nothing else
THE RULE. A change to this plugin (agent def, skill, hook, script, manifest) is tested in exactly one way: commit it, push it to
neurawork-git/n8n-autopilot-internal, install the plugin FROM that GitHub repo, restart, verify. Nothing else counts. A change you have not pushed-and-installed has not been tested — you are looking at stale or inconsistently-registered state.
Why (lessons paid for)
- Hand-copying files into
~/.claude/plugins/cache/.../<version>/registers inconsistently: agents silently fail to appear,/reload-pluginsdoes not pick up newly-added agents, and you end up with two plugins thinking different things. NEVER do it. - A directory-pointer marketplace (
extraKnownMarketplaces … source: directory) drifts from the committed truth and produces dual stale installs. Do not use it for testing. - Hand-editing
.claude/settings.jsonenabledPluginsdesyncs the install records. Use the CLI (claude plugin enable/disable). /reload-pluginsis NOT sufficient for newly-added agents/hooks — only a full session restart reliably registers them.
The flow
1. Commit + push + bump version
The installer is version-keyed: install/update no-op if the version already present. So every
test cycle bumps the version.
# bump .claude-plugin/plugin.json + .claude-plugin/marketplace.json version (e.g. 4.8.0 -> 4.8.1)
git add -A
git commit -F - <<'MSG'
<type>: <subject> # clean Conventional Commit — NO leading "@", umlauts correct (ä/ö/ü/ß)
<body>
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
MSG
git log -1 --format='[%s]' # verify subject is clean (no stray @)
git push origin main
2. Register the repo marketplace (once) — point at -internal, mind the name collision
We push to and install from neurawork-git/n8n-autopilot-internal (the dev repo). Its
marketplace.json name is n8n-autopilot — the same name as the public release marketplace
(neurawork-git/n8n-autopilot). Two marketplaces cannot share a name, so:
# if a `n8n-autopilot` marketplace already points at the PUBLIC repo, remove it first:
claude plugin marketplace list # check the Source of `n8n-autopilot`
claude plugin marketplace remove n8n-autopilot # only if it points at the public repo / a directory
claude plugin marketplace add neurawork-git/n8n-autopilot-internal # GitHub source = single truth
Never add a directory source for this name (that is the cache-drift trap).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 103 lines · 93 tokens per session scan A 1be4c2765d8e
plugin-testing is a skill published in the GitHub repository neurawork-git/n8n-autopilot (18 stars, last pushed 10d ago), licensed MIT. It adds 93 tokens to every session and 1,428 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-workflow
Universal n8n workflow testing via webhook or sub-workflow pattern.
n8n-testing
Testing workflow for n8n. Use before activating workflows in production. Covers manual testing, data pinning, execution modes, and validation.
live-preview
Mid-build visual verification loop. Takes screenshots of components during construction, not just after. Catches visual regressions and invisible features before they compound. Requires Playwright or similar screenshot tool.
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
eval-agent
Run evaluation tests against an agent to assess quality and archetype resistance.
api-testing
HTTP API testing for TypeScript (Supertest) and Python (httpx, pytest). Test REST APIs, GraphQL, request/response validation, authentication, and error handling.