Install
$ agentstack add skill-cboone-agent-harness-plugins-check-versions ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Check Versions
Verify that plugin versions and marketplace.json are correct and consistent after changes on the current branch.
Workflow
1. Determine the Comparison Base
Detect the default branch:
gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'
Fall back to local detection if gh is unavailable:
git rev-parse --abbrev-ref origin/HEAD | sed 's@^origin/@@'
Find the merge base between the default branch and HEAD:
git merge-base HEAD
If HEAD equals the merge base (on the default branch or no divergent commits), compare against the state before the most recent merge instead — use the most recent merge commit's first parent as the comparison base:
git rev-parse "$(git log --merges -1 --format='%H' HEAD)^1"
2. Identify Changed Plugins
List files changed since the comparison base and group them by plugin directory:
git diff --name-only ..HEAD
A file belongs to plugin foo if its path starts with plugins/foo/. For each plugin, track:
- Content changes: files other than
.claude-plugin/plugin.jsonthat were modified, added, or deleted - Version file changed: whether
.claude-plugin/plugin.jsonitself was modified
Also detect new plugins (directories at HEAD that did not exist at the base) and removed plugins (directories at the base that no longer exist).
3. Check Plugin Version Bumps
For each plugin with content changes:
- Read the current version from
plugins//.claude-plugin/plugin.json - Read the base version:
git show :plugins//.claude-plugin/plugin.json - Compare:
- New plugin (file absent at base) — version should be
1.0.0 - Content files changed but version unchanged — flag as missing version bump
- Version changed — verify the bump direction is forward, not a regression
Assess bump level (informational):
- Wording-only or prompt changes → patch
- New files, new capabilities → minor
- Deleted or restructured skill/hook files → major
4. Check Marketplace Sync
Read .claude-plugin/marketplace.json and verify:
- Version matching: each marketplace entry's
versionmatches itsplugin.json - Coverage: every
plugins/*/directory has a marketplace entry, and every marketplace entry points to an existing plugin directory - Metadata version:
metadata.versionis a catalog state tag in the formcatalog-M-m-p-n, derived from the marketplace plugin versions with no normalization or carry between components. Recompute it and verify the stored value matches. Prefer runningbin/compute-catalog-statedirectly (the canonical implementation, also consumed bybin/validate-pluginsand thereleaseworkflow); fall back to recomputing from.plugins[].versiononly if the script is missing.
5. Report
Output a structured report:
## Version Check Report
### Summary
### Plugin Changes
- ****: →
Changes:
Status: ✅ OK / ⚠️ Missing bump / ⚠️ Marketplace mismatch
### Marketplace Sync
- Plugin versions: ✅ All match / ⚠️ Mismatches listed
- Coverage: ✅ All registered / ⚠️ Missing or orphaned entries
- Metadata version: → — ✅ Correct / ⚠️ Issue described
### Recommended Actions
1.
If there are no issues, report a clean result summarizing what was checked.
6. Offer to Fix
If issues were found, ask the user whether to fix them:
- Missing version bumps → bump patch in
plugin.json(user can adjust level) - Marketplace mismatches → update
marketplace.jsonto matchplugin.json - Metadata version → recompute the catalog state tag from current plugin versions and update
metadata.versionto the new value - Missing marketplace entries → note that a full entry is needed (the create-plugin skill can help)
Only make changes after the user confirms.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: cboone
- Source: cboone/agent-harness-plugins
- License: MIT
- Homepage: https://github.com/cboone/agent-harness-plugins
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.