Ships with claude-skills. Installing the plugin gets this command.
⚡ How it fires
How this command gets triggered: by you, by Claude, or both.
Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/plugin-audit
👁️ Context preview
What this command does when you run it.
Comprehensive audit pipeline for skills, plugins, agents, and commands. Validates structure, quality, security, marketplace compliance, cross-platform compatibility, and ecosystem integration. Runs all built-in validation tools, invokes domain-appropriate agents for code review,
📊 Stats
Stars23,062
Forks3,139
LanguagePython
LicenseMIT
📦 Ships with claude-skills
</> Command definition
plugin-audit.md
---name: plugin-audit
description: |
Comprehensive audit pipeline for skills, plugins, agents, and commands. Validates structure,
quality, security, marketplace compliance, cross-platform compatibility, and ecosystem integration.
Runs all built-in validation tools, invokes domain-appropriate agents for code review,
and produces a pass/fail gate report. Usage: /plugin-audit <skill-path>
argument-hint: "<skill-path>"
---# /plugin-audit
Full audit pipeline for any skill, plugin, agent, or command in this repository. Runs 8 validation phases, auto-fixes what it can, and only stops for user input on critical decisions (breaking changes, new dependencies).
## Usage
```bash
/plugin-audit product-team/code-to-prd
/plugin-audit engineering/agenthub
/plugin-audit engineering-team/playwright-pro
```
## What It Does
Execute all 8 phases sequentially. Stop on critical failures. Auto-fix non-critical issues. Report results at the end.
---## Phase 1: Discovery
Identify what the skill contains and classify it.
1. Verify `{skill_path}` exists and contains `SKILL.md`
2. Read `SKILL.md` frontmatter — extract `name`, `description`, `Category`, `Tier`
**Gate rule:** All scripts must PASS. Any FAIL is a blocker. PARTIAL triggers a warning.
**Auto-fix:** If a script fails the `--help` test, check if it has `argparse` — if not, this is a real issue. If it fails the stdlib-only test, flag the import and **ask the user** whether the dependency is acceptable (this is a critical decision).
**Gate rule:** Zero CRITICAL findings. Zero HIGH findings. Any CRITICAL or HIGH is a blocker — report the exact file, line, pattern, and recommended fix.
**Do NOT auto-fix security issues.** Report them and let the user decide.
---
## Phase 6: Marketplace & Plugin Compliance
### 6a. plugin.json Validation
If `{skill_path}/.claude-plugin/plugin.json` exists:
| Other | cs-senior-engineer | General code and architecture review |
**How to invoke:** Read the agent's `.md` file to understand its review criteria. Apply those criteria to review the skill's SKILL.md, scripts, and references. This is NOT spawning a subagent — it's using the agent's documented perspective to structure your review.
Review checklist (apply domain-appropriate lens):
- [ ] SKILL.md workflows are actionable and complete
- [ ] Scripts solve the stated problem correctly
- [ ] References contain accurate domain knowledge