AgentStack
SKILL verified MIT Self-run

Plugin Review

skill-athola-claude-night-market-plugin-review · by athola

Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.

No reviews yet
0 installs
15 views
0.0% view→install

Install

$ agentstack add skill-athola-claude-night-market-plugin-review

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Plugin Review? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Plugin Review

Tiered quality review of plugins with dependency-aware scoping.

Table of Contents

  • [Tiers](#tiers)
  • [Orchestration](#orchestration)
  • [Scope Detection](#scope-detection)
  • [Module Loading](#module-loading)
  • [Verdict](#verdict)
  • [Output Format](#output-format)
  • [Quality Gate Mode](#quality-gate-mode)
  • [Configuration](#configuration)

Tiers

| Tier | Trigger | Scope | Depth | Duration | |------|---------|-------|-------|----------| | branch | Default | Affected and related | Quick gates | ~2 min | | pr | Before merge | Affected and related | Standard | ~5 min | | release | Before version bump | All 17 plugins | Full | ~15 min |

Orchestration

  1. Detect scope: parse --tier flag, find affected

plugins from git diff, resolve related plugins from docs/plugin-dependencies.json

  1. Plan: build check matrix (tier x plugin x role)
  2. Execute: run checks per tier definition
  3. Report: per-plugin table, aggregate verdict

Scope Detection

Affected plugins: git diff main --name-only filtered to plugins/*/.

Related plugins: load docs/plugin-dependencies.json, look up each affected plugin's reverse index to find dependents. Mark as "related" (lighter checks).

If --tier release or no git diff available, scope to all plugins.

Module Loading

  • Always: this SKILL.md (orchestration logic)
  • branch tier: load modules/tier-branch.md
  • pr tier: load modules/tier-branch.md then

modules/tier-pr.md

  • release tier: load all tier modules plus

modules/tier-release.md

  • When resolving deps: load

modules/dependency-detection.md

Verdict

| Result | Meaning | |--------|---------| | PASS | All checks green | | PASS-WITH-WARNINGS | Non-blocking issues | | FAIL | Blocking issues found |

Output Format

Plugin Review ( tier)
Affected: 
Related:   ()

Plugin          test  lint  type  reg   verdict
          PASS  PASS  PASS  PASS  PASS
...

Verdict:  (N/N plugins healthy)

PR and release tiers add scorecard sections.

Quality Gate Mode

The --quality-gate flag enables CI/CD integration with exit codes that distinguish warnings from failures:

  • 0: all quality gates passed
  • 1: warnings present but gates passed (non-blocking)
  • 2: quality gate failures (blocking)
  • 3: critical issues found (blocking)

Use --fail-on warning to treat warnings as blocking.

Configuration

Place a .plugin-review.yaml file in the plugin root to customize thresholds and focus areas:

plugin_review:
  quality_gates:
    structure_min: 80
    skills_min: 75
    hooks_min: 70
    tokens_max_total: 50000
    bloat_max_percentage: 15
  focus_areas:
    - skills
    - hooks
    - tokens
  exclude_patterns:
    - "*/legacy/*"
    - "*/deprecated/*"
  severity_overrides:
    missing_description: warning
    large_file: info

See the /plugin-review command reference for full usage examples.

Exit Criteria

  • [ ] The output includes a per-plugin table with columns: test, lint, type, reg, verdict, and

an aggregate PASS / PASS-WITH-WARNINGS / FAIL verdict.

  • [ ] Scope detection identifies affected plugins via git diff main --name-only filtered to

plugins/*/; if git diff is unavailable, the skill falls back to all-plugin scope and states this explicitly.

  • [ ] Any plugin scoring below the structure_min (default 80) or skills_min (default 75)

threshold is listed as a FAIL, not a warning.

  • [ ] --quality-gate mode returns exit code 2 for blocking failures and exit code 1 for

non-blocking warnings, distinguishable by the calling CI step.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.