pleaseai/validating-plugins
plugins/plugin-dev/skills/validating-plugins/SKILL.md
Thoroughly validate a Claude Code plugin's manifest, directory structure, commands, agents, skills, hooks, and MCP config, then report issues by severity. Use when the user asks to validate, check, audit, or lint a plugin, verify a plugin.json or plugin structure, debug why a plugin won't load, or mentions "plugin validate", "invalid manifest", or "plugin not loading".
$ install --global
skillsauthnpx skillsauth add pleaseai/claude-code-plugins validating-pluginsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 8, 2026, 6:35 AM248.4s1 file scanned
SKILL.md
- name:
- validating-plugins
- description:
- Thoroughly validate a Claude Code plugin's manifest, directory structure, commands, agents, skills, hooks, and MCP config, then report issues by severity. Use when the user asks to validate, check, audit, or lint a plugin, verify a plugin.json or plugin structure, debug why a plugin won't load, or mentions "plugin validate", "invalid manifest", or "plugin not loading".
Validating a Plugin
Perform a comprehensive validation of the plugin and report findings grouped by severity. Start with the CLI validator, then check what it does not cover.
claude plugin validate plugins/<name>
claude plugin validate .claude-plugin/marketplace.json
1. Manifest (.claude-plugin/plugin.json)
- ✅ Exists at the correct path (
.claude-plugin/plugin.json, not root only). - ✅ Valid JSON syntax.
- ✅ Required:
name(string, kebab-case). - ✅ Recommended:
version(valid semver),description,author,repository,keywords. - ✅ Optional
$schemaset tohttps://json.schemastore.org/claude-code-plugin-manifest.json. - ✅ Custom component paths start with
./and are relative. - ✅ Env/command paths use
${CLAUDE_PLUGIN_ROOT}.
2. Directory structure
- ✅
.claude-plugin/holdsplugin.jsononly. - ✅
commands/,agents/,skills/,hooks/are at the plugin root. - ✅
README.mdandLICENSEpresent. - ❌ No commands/agents/skills/hooks nested inside
.claude-plugin/.
3. Commands
For each .md in commands/: valid Markdown, kebab-case filename, clear actionable content,
frontmatter where useful, descriptive summary.
4. Skills
For each skills/<name>/SKILL.md: YAML frontmatter present with name (gerund form) and a
description that carries specific activation triggers; body under ~500 lines.
5. Hooks
- ✅
hooks/hooks.jsonis valid JSON. - ✅ Hook scripts are executable (
chmod +x). - ✅ Scripts use
${CLAUDE_PLUGIN_ROOT}. - ✅ Output shape matches the hook spec (
hookSpecificOutput). - ⚠️ Hook event names are valid.
6. MCP servers
- ✅ Valid config in inline
mcpServersor.mcp.json. - ✅ Command paths exist;
npx -ypattern where applicable. - ✅ Optional env vars use the
${VAR:-}pattern.
7. Agents & documentation
- ✅ Each agent has a clear description, capabilities, when-to-use guidance, and examples.
- ✅ README has installation instructions, usage examples, features, and a license;
CHANGELOG.mdrecommended.
Process
- Scan the plugin directory (Glob/Read) and confirm required files exist.
- Parse and validate the manifest fields, paths, and env vars.
- Check component integrity and script permissions.
- Report findings with specific
file:linereferences and actionable fixes.
Output format
# Plugin Validation Report: <plugin-name>
## Critical Issues ❌
- [FILE:LINE] Issue — Fix: specific solution
## Warnings ⚠️
- [FILE:LINE] Issue — Recommendation: suggested improvement
## Suggestions 💡
- [FILE:LINE] Enhancement — Suggestion: how to improve
## Summary
- Total: X · Critical: X · Warnings: X · Suggestions: X
## Next Steps
1. Fix critical issues first
2. Address warnings for quality
3. Consider suggestions
Related Skills
pleaseai/plugins/workflow-sdk/agent/skills/workflow
tools
VerifiedTrustedCommunity
Creates durable, resumable workflows using Vercel's Workflow SDK. Use when building workflows that need to survive restarts, pause for external events, retry on failure, or coordinate multi-step operations over time. Triggers on mentions of "workflow", "durable functions", "resumable", "workflow sdk", "queue", "event", "push", "subscribe", or step-based orchestration.
11SKILL.mdUpdated Jul 8, 2026
pleaseai/plugins/workflow-sdk/agent/skills/workflow-init
tools
VerifiedTrustedCommunity
Install and configure Vercel Workflow SDK before it exists in node_modules. Use when the user asks to "install workflow", "set up workflow", "add durable workflows", "configure workflow sdk", or "init workflow" for Next.js, Express, Hono, Fastify, NestJS, Nitro, Nuxt, Astro, SvelteKit, or Vite.
11SKILL.mdUpdated Jul 8, 2026
pleaseai/plugins/workflow-sdk/agent/skills/migrating-to-workflow-sdk
tools
VerifiedTrustedCommunity
Migrates Temporal, Inngest, Trigger.dev, and AWS Step Functions workflows to the Workflow SDK. Use when porting Activities, Workers, Signals, step.run(), step.waitForEvent(), Trigger.dev tasks / wait.forToken / triggerAndWait, ASL JSON state machines, Task/Choice/Wait/Parallel states, task tokens, or child workflows.
11SKILL.mdUpdated Jul 8, 2026
pleaseai/plugins/wordpress/agent/skills/wpds
tools
VerifiedTrustedCommunity
Use when building UIs leveraging the WordPress Design System (WPDS) and its components, tokens, patterns, etc.
11SKILL.mdUpdated Jul 8, 2026