Install
$ agentstack add skill-athola-claude-night-market-plugin-review ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Plugin Review
Tiered quality review of plugins with dependency-aware scoping.
Table of Contents
- [Tiers](#tiers)
- [Orchestration](#orchestration)
- [Scope Detection](#scope-detection)
- [Module Loading](#module-loading)
- [Verdict](#verdict)
- [Output Format](#output-format)
- [Quality Gate Mode](#quality-gate-mode)
- [Configuration](#configuration)
Tiers
| Tier | Trigger | Scope | Depth | Duration | |------|---------|-------|-------|----------| | branch | Default | Affected and related | Quick gates | ~2 min | | pr | Before merge | Affected and related | Standard | ~5 min | | release | Before version bump | All 17 plugins | Full | ~15 min |
Orchestration
- Detect scope: parse
--tierflag, find affected
plugins from git diff, resolve related plugins from docs/plugin-dependencies.json
- Plan: build check matrix (tier x plugin x role)
- Execute: run checks per tier definition
- Report: per-plugin table, aggregate verdict
Scope Detection
Affected plugins: git diff main --name-only filtered to plugins/*/.
Related plugins: load docs/plugin-dependencies.json, look up each affected plugin's reverse index to find dependents. Mark as "related" (lighter checks).
If --tier release or no git diff available, scope to all plugins.
Module Loading
- Always: this SKILL.md (orchestration logic)
- branch tier: load
modules/tier-branch.md - pr tier: load
modules/tier-branch.mdthen
modules/tier-pr.md
- release tier: load all tier modules plus
modules/tier-release.md
- When resolving deps: load
modules/dependency-detection.md
Verdict
| Result | Meaning | |--------|---------| | PASS | All checks green | | PASS-WITH-WARNINGS | Non-blocking issues | | FAIL | Blocking issues found |
Output Format
Plugin Review ( tier)
Affected:
Related: ()
Plugin test lint type reg verdict
PASS PASS PASS PASS PASS
...
Verdict: (N/N plugins healthy)
PR and release tiers add scorecard sections.
Quality Gate Mode
The --quality-gate flag enables CI/CD integration with exit codes that distinguish warnings from failures:
0: all quality gates passed1: warnings present but gates passed (non-blocking)2: quality gate failures (blocking)3: critical issues found (blocking)
Use --fail-on warning to treat warnings as blocking.
Configuration
Place a .plugin-review.yaml file in the plugin root to customize thresholds and focus areas:
plugin_review:
quality_gates:
structure_min: 80
skills_min: 75
hooks_min: 70
tokens_max_total: 50000
bloat_max_percentage: 15
focus_areas:
- skills
- hooks
- tokens
exclude_patterns:
- "*/legacy/*"
- "*/deprecated/*"
severity_overrides:
missing_description: warning
large_file: info
See the /plugin-review command reference for full usage examples.
Exit Criteria
- [ ] The output includes a per-plugin table with columns: test, lint, type, reg, verdict, and
an aggregate PASS / PASS-WITH-WARNINGS / FAIL verdict.
- [ ] Scope detection identifies affected plugins via
git diff main --name-onlyfiltered to
plugins/*/; if git diff is unavailable, the skill falls back to all-plugin scope and states this explicitly.
- [ ] Any plugin scoring below the
structure_min(default 80) orskills_min(default 75)
threshold is listed as a FAIL, not a warning.
- [ ]
--quality-gatemode returns exit code 2 for blocking failures and exit code 1 for
non-blocking warnings, distinguishable by the calling CI step.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: athola
- Source: athola/claude-night-market
- License: MIT
- Homepage: https://athola.github.io/claude-night-market
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.