Plugin Dev
Validate plugin SKILL.md frontmatter and audit hook scripts for silent failures. Run validation to check all plugins pass schema, source path, and frontmatter checks. Run hook audit to detect unhandled errors in shell and Python scripts.
Install
$ agentstack add skill-rube-de-cc-skills-plugin-dev ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-rube-de-cc-skills-plugin-dev) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Plugin Development Tools
On-demand validation and hook auditing for the cc-skills marketplace.
Triggers
Use this skill when the user says: "validate plugins", "check plugin", "hook audit", "validate skills", "audit hooks", "check skill frontmatter", "plugin validation".
Available Tools
1. Plugin Validation
Validates all registered plugins: JSON Schema, source paths, orphan detection, and SKILL.md frontmatter.
bun scripts/validate-plugins.mjsWhat it checks:
- marketplace.json conforms to JSON Schema
- All plugin
sourcepaths exist on disk - No orphaned plugin directories (dirs without marketplace entries)
- SKILL.md frontmatter has valid
name(kebab-case) and non-emptydescription - Every plugin has at least one component directory (skills/, hooks/, commands/, agents/)
2. Hook Audit
Scans hook and script files for silent failure patterns.
bash plugins/plugin-dev/scripts/audit-hooks.shWhat it checks:
- Shell scripts (
.sh):mkdir/cp/mv/rmwithout error handling (unlessset -eis active) - Python scripts (
.py): bareexcept: passorexcept Exception: pass - Optional: ShellCheck integration (skipped with message if not installed)
Exit codes: 0 = clean, 1 = findings
Workflow
When the user asks to validate or audit:
- Run
bun scripts/validate-plugins.mjsfor plugin validation - Run
bash plugins/plugin-dev/scripts/audit-hooks.shfor hook auditing - Report results clearly — separate passing checks from failures
- For failures, suggest specific fixes
Scaffolding
To scaffold a new plugin interactively, use the command:
/plugin-dev:create [plugin-name]This is a separate slash command — not part of this skill.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: rube-de
- Source: rube-de/cc-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.