/plugin-review

name: plugin-review
description: "Tiered plugin quality review: branch (quick gates),
  pr (quality scoring), release (full ecosystem audit).
  Detects affected plugins from git diff and reviews
  related plugins for side effects."
usage: "/plugin-review [plugin-name...] [--tier branch|pr|release]
  [--focus skills|hooks|bloat|tokens|all]
  [--format summary|detailed|json] [--plan]"

Plugin Review

Tiered plugin quality review: branch (quick gates), pr (quality scoring), release (full ecosystem audit). Detects affected plugins from git diff and reviews related plugins for side effects.

When To Use

Use this command when you need to:

• Assessing overall plugin/skill architecture health
• Pre-release validation of plugin quality
• Quarterly maintenance audits
• New contributor onboarding to understand plugin structure
• Identifying improvement priorities across skills/commands/hooks
• Validating plugin meets quality standards

When NOT To Use

Avoid this command if:

• Single skill analysis - use /analyze-skill
• Single hook analysis - use /analyze-hook
• Creating new skills - use /create-skill
• Token estimation only - use /estimate-tokens

Usage

# Review current plugin (default: all checks)
/plugin-review

# Review specific plugin
/plugin-review plugins/abstract

# Focus on specific aspect
/plugin-review --focus skills
/plugin-review --focus hooks
/plugin-review --focus bloat
/plugin-review --focus tokens

# Output format
/plugin-review --format summary   # High-level scores (default)
/plugin-review --format detailed  # Full findings and recommendations
/plugin-review --format json      # Machine-readable for CI

# CI/CD quality gate mode
/plugin-review --quality-gate --fail-on warning

Tiers

| Tier | Default | Scope | Duration | |------|---------|-------|----------| | branch | Yes | Affected and related plugins | ~2 min | | pr | No | Affected and related, deeper | ~5 min | | release | No | All 17 plugins | ~15 min |

# Default: branch tier on changed plugins
/plugin-review

# Explicit tier selection
/plugin-review --tier branch
/plugin-review --tier pr
/plugin-review --tier release

# Specific plugins with tier
/plugin-review sanctum memory-palace --tier pr

# Dry-run: show what would be reviewed
/plugin-review --plan

Branch tier runs quick gates (test, lint, typecheck, registration). PR tier adds quality scoring (skills-eval, hooks-eval, test-review, bloat-scan). Release tier runs full ecosystem audit across all plugins.

See `skills/plugin-review/SKILL.md` for orchestration details and module loading.

What It Reviews

1. Plugin Structure Validation

Validates plugin.json, directory structure, naming conventions, and path references.

**Source**: `abstract:plugin-validator` agent, `validate_plugin.py` script

2. Skills Quality Assessment

Evaluates all skills against quality standards:

• Structure compliance (frontmatter, modular design)
• Content quality (clarity, completeness, examples)
• Token efficiency (progressive loading, context optimization)
• Trigger reliability (activation patterns, discoverability)
• Tool integration (executable components, error handling)

**Source**: `abstract:skills-eval` skill, `skill_analyzer.py` script

3. Commands Review

Checks all commands for:

• Proper frontmatter (name, description, usage)
• Argument documentation
• Implementation references
• Integration with skills/agents

**Source**: `validate_plugin.py` command validation

4. Hooks Evaluation

Thorough hook analysis:

• Security scanning (command injection, secrets exposure)
• Performance benchmarking (execution time, memory usage)
• Compliance validation (structure, error handling)
• Reliability assessment (timeout management, idempotency)

**Source**: `abstract:hooks-eval` skill, hooks evaluation scripts

5. Agent Assessment

Reviews all agents for:

• Model appropriateness (haiku vs sonnet vs opus)
• Escalation rules configuration
• Tool restrictions
• Description clarity and examples

**Source**: Plugin structure validation

6. Token Efficiency Analysis

Evaluates context window impact:

• Total token budget across all skills
• Large file identification (>5KB threshold)
• Progressive loading implementation
• Module structure optimization

**Source**: `context_optimizer.py`, `token_estimator.py` scripts

7. Bloat Detection

Identifies codebase bloat:

• Dead code and unused files
• Duplicate content across skills
• Overly verbose documentation
• Stale files (unchanged 6+ months)

**Source**: `conserve:bloat-detector` skill

Output Format

Summary Report (Default)

PLUGIN ARCHITECTURE REVIEW - abstract v1.2.4

HEALTH SCORES
-------------------------------------------------------------
Plugin Structure    ████████████████████░░  85/100 GOOD
Skills Quality      █████████████████████░  92/100 EXCELLENT
Commands            ████████████████████░░  88/100 GOOD
Hooks               ████████████████░░░░░░  75/100 OK
Token Efficiency    ████████████████████░░  82/100 GOOD
Bloat Score         ████████████████████░░  90/100 GOOD
-------------------------------------------------------------
OVERALL SCORE       ████████████████████░░  85/100 GOOD

INVENTORY
-------------------------------------------------------------
Skills:   18 (15 passing, 3 need attention)
Commands: 12 (all passing)
Hooks:     5 (4 passing, 1 security warning)
Agents:    4 (all passing)
Modules:  24 (23 optimal size, 1 needs split)

TOP PRIORITIES
-------------------------------------------------------------
[HIGH] hooks/gemini-bridge.py:23 - unsafe dynamic code execution
[MED]  skills/legacy-workflow/SKILL.md - 847 lines
[MED]  skills/old-patterns/ - unchanged 8 months
[LOW]  3 skills missing trigger phrases

RECOMMENDATION: Address HIGH priority security issue before release.
Run `/plugin-review --format detailed` for full analysis.

Detailed Report

Includes:

• Per-skill breakdown with scores
• Per-hook security analysis
• Token budget breakd