Plugin Audit
Audit a Claude Code plugin — structure, permissions, packaging — so issues surface before it ships.
Before & after
Same prompt, same agent — the only difference is the skill.
There are several important things to check before releasing a WordPress plugin to the public. Code quality matters significantly - make sure it follows WordPress coding standards and best practices. Security is absolutely critical - all inputs should be validated and sanitized properly. You need to test it on different WordPress versions to ensure compatibility. Documentation should be clear and helpful for end users. Performance should be acceptable because slow plugins frustrate users and hurt retention. You might want to check compatibility with common plugins that your users might have. Does it have proper error handling? I could help you think through some of these areas in more detail if you'd like.
WORDPRESS PLUGIN AUDIT REPORT - PRODUCTION READINESS CODE QUALITY: PASS ✓ WordPress coding standards applied (nonces, escaping, sanitization) ✓ No direct database queries - all via wpdb prepared statements ✓ Plugin follows object-oriented structure with main class file ✓ Auto-loader implemented for class files ✓ 94 functions documented with PHPDoc blocks Rating: 8.2/10 SECURITY AUDIT: PARTIAL - 2 Issues Found ✗ CRITICAL: User input validation missing on custom endpoint /wp-json/custom/upload Risk: Arbitrary file upload vulnerability. Fix: Add capability check + nonce verification Severity: P0. Priority: FIX BEFORE RELEASE ✗ WARNING: No rate limiting on login form. Risk: Brute force attacks Mitigation: Add wp_rate_limit hook, max 5 attempts per 15 minutes per IP Severity: P2. Can ship with mitigation in place Rating: 6.1/10 (down from 8.5/10 due to critical issue) COMPATIBILITY: PASS ✓ Tested on WordPress 6.3, 6.4, 6.5 - all functional ✓ Conflicts checked against: Akismet, Jetpack, WooCommerce, Elementor, Yoast SEO ✓ PHP 7.4+ requirement declared in readme.txt Rating: 8.8/10 PERFORMANCE: PASS ✓ Lazy-loading implemented for admin settings page (loads 340ms faster) ✓ Database queries optimized - 4 queries on front-end (acceptable, median 3.2) ✓ Asset loading via wp_enqueue_scripts hook (no inline scripts) ✓ CSS/JS minified, delivered via CDN Rating: 7.9/10 RELEASE RECOMMENDATION: DO NOT RELEASE until critical security issue is patched. Estimated fix time: 45 minutes (add nonce validation to upload endpoint). Retest after patch, then cleared for production deployment.
About this skill
name: plugin-audit description: Use when Structured Claude skill that gives Claude a repeatable workflow for plugin audit.
Plugin Audit
One of 337+ skills in the original author's multi-agent claude-skills mega-collection (~19k GitHub stars). Packages the Plugin Audit workflow with its own instructions and validation so outputs stay consistent.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the plugin-audit skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Plugin Audit; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: plugin-audit
description: Use this skill when a Claude Code plugin needs a structured review for correctness, security, and packaging quality before publishing or updating it.
version: 1.0.0
category: AI Agents / Development
author: AgentVolt
license: proprietary
tags:
- ai-agents
- development
---
# Plugin Audit
Runs a repeatable audit workflow over a Claude Code plugin — checking structure, permissions, and packaging — so issues surface before the plugin ships or updates.
## When to use
… (sign up to view the full skill)More ai & agents skills
View all AI & Agents skills →Skill Status Report
Scan every skill in a project and report which pass validation, which are stale, and which lack required metadata.
Skills Scaffolder
Scaffold a new skills directory — folder structure, metadata, a baseline validation pass — with the right conventions from day one.
Research Bundle
Run a multi-step research task as one pipeline: gather sources, extract findings, validate consistency, emit one structured bundle.
Workspace Admin
Administer a Cowork or Claude workspace — settings, access, configuration — with every change scoped and verified.