Claude Code Plugin Audit
Audit a Claude Code plugin before shipping: manifest, skills, commands, agents, hooks, MCP config, secrets, and packaging.
Before & after
Same prompt, same agent — the only difference is the skill.
There are several important things to check before releasing a WordPress plugin to the public. Code quality matters significantly - make sure it follows WordPress coding standards and best practices. Security is absolutely critical - all inputs should be validated and sanitized properly. You need to test it on different WordPress versions to ensure compatibility. Documentation should be clear and helpful for end users. Performance should be acceptable because slow plugins frustrate users and hurt retention. You might want to check compatibility with common plugins that your users might have. Does it have proper error handling? I could help you think through some of these areas in more detail if you'd like.
WORDPRESS PLUGIN AUDIT REPORT - PRODUCTION READINESS CODE QUALITY: PASS ✓ WordPress coding standards applied (nonces, escaping, sanitization) ✓ No direct database queries - all via wpdb prepared statements ✓ Plugin follows object-oriented structure with main class file ✓ Auto-loader implemented for class files ✓ 94 functions documented with PHPDoc blocks Rating: 8.2/10 SECURITY AUDIT: PARTIAL - 2 Issues Found ✗ CRITICAL: User input validation missing on custom endpoint /wp-json/custom/upload Risk: Arbitrary file upload vulnerability. Fix: Add capability check + nonce verification Severity: P0. Priority: FIX BEFORE RELEASE ✗ WARNING: No rate limiting on login form. Risk: Brute force attacks Mitigation: Add wp_rate_limit hook, max 5 attempts per 15 minutes per IP Severity: P2. Can ship with mitigation in place Rating: 6.1/10 (down from 8.5/10 due to critical issue) COMPATIBILITY: PASS ✓ Tested on WordPress 6.3, 6.4, 6.5 - all functional ✓ Conflicts checked against: Akismet, Jetpack, WooCommerce, Elementor, Yoast SEO ✓ PHP 7.4+ requirement declared in readme.txt Rating: 8.8/10 PERFORMANCE: PASS ✓ Lazy-loading implemented for admin settings page (loads 340ms faster) ✓ Database queries optimized - 4 queries on front-end (acceptable, median 3.2) ✓ Asset loading via wp_enqueue_scripts hook (no inline scripts) ✓ CSS/JS minified, delivered via CDN Rating: 7.9/10 RELEASE RECOMMENDATION: DO NOT RELEASE until critical security issue is patched. Estimated fix time: 45 minutes (add nonce validation to upload endpoint). Retest after patch, then cleared for production deployment.
About this skill
Catch the problems that stop a plugin from loading or triggering, or that make it unsafe to install, before your users do. Every finding points to a file and gives the exact fix.
What it does
- Checks the directory layout and plugin.json manifest, and runs the CLI validator when your version has one
- Reviews skill descriptions for trigger quality, command frontmatter, and least-privilege tool access for commands and agents
- Audits hooks for scoped matchers, portable ${CLAUDE_PLUGIN_ROOT} paths, timeouts, and exit codes
- Scans for committed secrets, download-and-execute scripts, unexplained network calls, and prompt instructions that bypass safety
- Checks the README, marketplace.json entry, and packaging hygiene
What you get
An audit report with a verdict, a component inventory, blockers, should-fix items, and nits with fixes, a security summary, validator output, and suggested description rewrites.
Best for
Plugin authors publishing to a team or public marketplace, and teams vetting third-party plugins before installing.
SKILL.md preview
---
name: claude-code-plugin-audit
description: Audit a Claude Code plugin before it ships - manifest, directory layout, skills, commands, agents, hooks, MCP server config, permissions, secrets, and marketplace packaging - and return a pass/fail report with exact file fixes. Use when the user says "audit my plugin", "is this plugin ready to publish", "why isn't my skill/command loading", "review my hooks for safety", or before submitting a plugin to a marketplace, including casual asks like "can you check my plugin", "my skill isn't showing up", or "is this hook safe".
---
# Claude Code Plugin Audit
… (sign up to view the full skill)More development skills
View all Development skills →Performance Bottleneck Profiling: Node, Python, Go
Classifies a slowdown, gives exact profiler commands, reads the output, and proves the fix with same-conditions p95/p99 numbers.
Feature Scaffolding with Working Tests
Turn a short feature spec into code, runnable tests, and integration wiring that match your existing project.
Feature Flag Rollouts and Kill Switches
Design staged flag rollouts, verify rollback paths, and audit flag debt with explicit defaults, gates, and retirement plans.
Microcontroller Firmware and RTOS Engineering
Build and debug MCU firmware with bounded ISR/RTOS timing, safe DMA ownership, and measured power budgets.