open/config-audit
1
0
Fork 0
Code Issues Pull requests Releases Activity

feat(plh): validate plugin.json skills:-array entries (CA-PLH-016)

Browse source 
PLH now validates each entry of a plugin.json `skills` field (string|array):
every entry must resolve to an existing directory inside the plugin root.
One finding per bad entry (medium, plugin-hygiene), problem ∈ {non-string,
escapes-root, not-found, not-a-directory}. Mirrors `claude plugin validate`.
String|array normalized so a non-string top-level value is caught too.

Verifiseringsplikt: the plan's "CC suggests the parent directory" error text
is NOT in the primary docs — dropped. Only the four primary-source-verified
conditions are asserted (escape backed by the path-traversal rule).

Tests +3 (941->944). Scanner count unchanged (13). --json/--raw byte-stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 21:56:57 +02:00
commit 76d5eda101
9 changed files with 189 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
README.md
View file

@ -12,7 +12,7 @@
![Commands](https://img.shields.io/badge/commands-18-green)
![Agents](https://img.shields.io/badge/agents-6-orange)
![Hooks](https://img.shields.io/badge/hooks-4-red)
![Tests](https://img.shields.io/badge/tests-941+-brightgreen)
![Tests](https://img.shields.io/badge/tests-944+-brightgreen)
![License](https://img.shields.io/badge/license-MIT-lightgrey)
A Claude Code plugin that checks configuration health, suggests context-aware improvements, and auto-fixes issues — `CLAUDE.md`, `settings.json`, hooks, rules, MCP servers, `@imports`, and plugins. 13 deterministic scanners across 10 quality areas, context-aware feature recommendations, auto-fix with backup/rollback, a prompt-cache-aware Token Hotspots scanner with optional API-calibrated `--accurate-tokens` mode, plus cache-prefix stability, dead-tool, and cross-plugin collision detection. Zero external dependencies.
@ -383,6 +383,16 @@ By default, `/config-audit` auto-detects scope from your git context. Override w
> flag a custom path that points back into the default folder (e.g.
> `"commands": ["./commands/x.md"]`), because the folder is then addressed explicitly.
> **`skills:`-array validation — every listed path must be a real skill folder.**
> A plugin's `plugin.json` may list custom skill directories in a `skills` array (each entry a
> path to a folder containing `SKILL.md`). PLH validates each entry (`CA-PLH-016`, **medium**)
> and flags four ways an entry can be broken: it isn't a string, it points at a path that
> **doesn't exist**, it points at a **file** instead of a directory, or it **escapes the plugin
> root** (`../…` — installed plugins can't reference files outside their own directory, so the
> skill never loads). A valid existing directory is never flagged. This mirrors
> `claude plugin validate`. Note `skills` *adds to* the default `skills/` scan, so a custom path
> here is never a shadow — it just has to resolve to a real folder.
### CLI Tools
All tools work standalone — no Claude Code session needed: