athola/plugin-review
plugins/abstract/skills/plugin-review/SKILL.md
Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.
$ install --global
skillsauthnpx skillsauth add athola/claude-night-market plugin-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 30, 2026, 4:04 AM341.8s5 files scanned
SKILL.md
- name:
- plugin-review
- description:
- Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.
- alwaysApply:
- false
- category:
- plugin-management
- progressive_loading:
- true
- model_hint:
- standard
Plugin Review
Tiered quality review of plugins with dependency-aware scoping.
Table of Contents
- Tiers
- Orchestration
- Scope Detection
- Module Loading
- Verdict
- Output Format
- Quality Gate Mode
- Configuration
Tiers
| Tier | Trigger | Scope | Depth | Duration | |------|---------|-------|-------|----------| | branch | Default | Affected and related | Quick gates | ~2 min | | pr | Before merge | Affected and related | Standard | ~5 min | | release | Before version bump | All 17 plugins | Full | ~15 min |
Orchestration
- Detect scope: parse
--tierflag, find affected plugins from git diff, resolve related plugins fromdocs/plugin-dependencies.json - Plan: build check matrix (tier x plugin x role)
- Execute: run checks per tier definition
- Report: per-plugin table, aggregate verdict
Scope Detection
Affected plugins: git diff main --name-only filtered to
plugins/*/.
Related plugins: load docs/plugin-dependencies.json,
look up each affected plugin's reverse index to find
dependents. Mark as "related" (lighter checks).
If --tier release or no git diff available, scope to
all plugins.
Module Loading
- Always: this SKILL.md (orchestration logic)
- branch tier: load
modules/tier-branch.md - pr tier: load
modules/tier-branch.mdthenmodules/tier-pr.md - release tier: load all tier modules plus
modules/tier-release.md - When resolving deps: load
modules/dependency-detection.md
Verdict
| Result | Meaning | |--------|---------| | PASS | All checks green | | PASS-WITH-WARNINGS | Non-blocking issues | | FAIL | Blocking issues found |
Output Format
Plugin Review (<tier> tier)
Affected: <list>
Related: <list> (<reason>)
Plugin test lint type reg verdict
<name> PASS PASS PASS PASS PASS
...
Verdict: <PASS|PASS-WITH-WARNINGS|FAIL> (N/N plugins healthy)
PR and release tiers add scorecard sections.
Quality Gate Mode
The --quality-gate flag enables CI/CD integration with
exit codes that distinguish warnings from failures:
0: all quality gates passed1: warnings present but gates passed (non-blocking)2: quality gate failures (blocking)3: critical issues found (blocking)
Use --fail-on warning to treat warnings as blocking.
Configuration
Place a .plugin-review.yaml file in the plugin root
to customize thresholds and focus areas:
plugin_review:
quality_gates:
structure_min: 80
skills_min: 75
hooks_min: 70
tokens_max_total: 50000
bloat_max_percentage: 15
focus_areas:
- skills
- hooks
- tokens
exclude_patterns:
- "*/legacy/*"
- "*/deprecated/*"
severity_overrides:
missing_description: warning
large_file: info
See the /plugin-review command reference for full
usage examples.
Related Skills
athola/friction-detector
tools
VerifiedTrustedCommunity
Detect friction signals; graduate patterns into rules. Use for session retrospectives.
300SKILL.mdUpdated Apr 23, 2026
athola/validate-mr
testing
VerifiedTrustedCommunity
Use when you need a diff-derived test plan for an MR — reads the diff, groups changes by area, runs targeted verifications, and proves revert-tests are genuine guards, not dead assertions.
294SKILL.mdUpdated May 30, 2026
athola/palace-index-curator
development
VerifiedTrustedCommunity
Curate the web-capture index. Use when the capture backlog grows, captures sit unprocessed at seedling/pending, or to surface stored research during work.
294SKILL.mdUpdated May 30, 2026
athola/memory-clarity-probe
testing
VerifiedTrustedCommunity
Probe memory/summary clarity via dual anchor questions: task progress, info gaps. Use when verifying session state or summary before handoff or compression.
294SKILL.mdUpdated May 30, 2026