# Plugin Dev

> Validate plugin SKILL.md frontmatter and audit hook scripts for silent failures. Run validation to check all plugins pass schema, source path, and frontmatter checks. Run hook audit to detect unhandled errors in shell and Python scripts.

- **Type:** Skill
- **Install:** `agentstack add skill-rube-de-cc-skills-plugin-dev`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [rube-de](https://agentstack.voostack.com/s/rube-de)
- **Installs:** 0
- **Category:** [Communication](https://agentstack.voostack.com/c/communication)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [rube-de](https://github.com/rube-de)
- **Source:** https://github.com/rube-de/cc-skills/tree/main/plugins/plugin-dev/skills/plugin-dev

## Install

```sh
agentstack add skill-rube-de-cc-skills-plugin-dev
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Plugin Development Tools

On-demand validation and hook auditing for the cc-skills marketplace.

## Triggers

Use this skill when the user says: "validate plugins", "check plugin", "hook audit", "validate skills", "audit hooks", "check skill frontmatter", "plugin validation".

## Available Tools

### 1. Plugin Validation

Validates all registered plugins: JSON Schema, source paths, orphan detection, and SKILL.md frontmatter.

```bash
bun scripts/validate-plugins.mjs
```

**What it checks:**
- marketplace.json conforms to JSON Schema
- All plugin `source` paths exist on disk
- No orphaned plugin directories (dirs without marketplace entries)
- SKILL.md frontmatter has valid `name` (kebab-case) and non-empty `description`
- Every plugin has at least one component directory (skills/, hooks/, commands/, agents/)

### 2. Hook Audit

Scans hook and script files for silent failure patterns.

```bash
bash plugins/plugin-dev/scripts/audit-hooks.sh
```

**What it checks:**
- Shell scripts (`.sh`): `mkdir`/`cp`/`mv`/`rm` without error handling (unless `set -e` is active)
- Python scripts (`.py`): bare `except: pass` or `except Exception: pass`
- Optional: ShellCheck integration (skipped with message if not installed)

**Exit codes:** 0 = clean, 1 = findings

## Workflow

When the user asks to validate or audit:

1. Run `bun scripts/validate-plugins.mjs` for plugin validation
2. Run `bash plugins/plugin-dev/scripts/audit-hooks.sh` for hook auditing
3. Report results clearly — separate passing checks from failures
4. For failures, suggest specific fixes

## Scaffolding

To scaffold a new plugin interactively, use the command:

```
/plugin-dev:create [plugin-name]
```

This is a separate slash command — not part of this skill.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [rube-de](https://github.com/rube-de)
- **Source:** [rube-de/cc-skills](https://github.com/rube-de/cc-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-rube-de-cc-skills-plugin-dev
- Seller: https://agentstack.voostack.com/s/rube-de
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.