Loading...
Loading...
Use when analyzing plugin structures, MCP tools, and plugin security patterns.
npx skill4agent add avifenesh/agentsys enhance-pluginsconst args = '$ARGUMENTS'.split(' ').filter(Boolean);
const targetPath = args.find(a => !a.startsWith('--')) || '.';
const fix = args.includes('--fix');| Platform | Location |
|---|---|
| Claude Code | |
| OpenCode | |
| Codex | MCP in |
plugins/plugin.json--fix{
"name": "verb_noun",
"description": "What it does. When to use. What it returns.",
"input_schema": {
"type": "object",
"properties": {
"param": {
"type": "string",
"description": "Format and example"
}
},
"required": ["param"],
"additionalProperties": false
}
}| Issue | Certainty | Auto-Fix |
|---|---|---|
Missing | HIGH | Yes |
Missing | HIGH | Yes |
| Missing tool description | HIGH | No |
| Missing param descriptions | MEDIUM | No |
Vague names ( | MEDIUM | No |
// Bad - vague
"description": "Search for things"
// Good - complete
"description": "Search product catalog by keyword. Use for inventory queries or price checks. Returns matching products with prices."// Bad
"query": { "type": "string" }
// Good
"query": {
"type": "string",
"description": "Search keywords. Supports AND/OR. Example: 'laptop AND gaming'"
}| Issue | Why It Matters |
|---|---|
| Deep nesting (>2 levels) | Reduces generation quality |
| Missing enums for constrained values | Allows invalid states |
| No min/max on numbers | Unbounded inputs |
| >20 tools per plugin | Increases error rates |
// Bad - nested
{ "config": { "settings": { "timeout": 30 } } }
// Good - flat
{ "timeout_seconds": 30 }plugin-name/
├── .claude-plugin/
│ └── plugin.json # name, version, description
├── commands/ # User-invokable commands
├── agents/ # Subagent definitions
├── skills/ # Reusable skill implementations
└── package.json # Optional, for npm pluginsnameversion^\d+\.\d+\.\d+$descriptionstdiohttp{
"mcp": {
"server-name": {
"type": "local",
"command": ["node", "path/to/server.js"],
"environment": { "KEY": "value" },
"enabled": true
}
}
}| Pattern | Risk | Detection |
|---|---|---|
Unrestricted | Command execution | |
| Command injection | Shell escape | |
| Path traversal | File access | |
| Hardcoded secrets | Credential leak | API keys, passwords |
| Pattern | Risk |
|---|---|
| Broad file access | Data exfiltration |
| Missing input validation | Injection attacks |
| No timeout on tools | Resource exhaustion |
// Validate before execution
function validateToolInput(params, schema) {
// Type validation
// Range validation (min/max)
// Enum validation
// Format validation (regex patterns)
}{
"type": "tool_result",
"tool_use_id": "id",
"content": "Error: [TYPE]. [WHAT]. [SUGGESTION].",
"is_error": true
}| Issue | Fix |
|---|---|
Missing | Add |
Missing | Add all properties to required array |
| Version mismatch | Sync plugin.json with package.json |
## Plugin Analysis: {name}
**Files scanned**: {count}
| Certainty | Count |
|-----------|-------|
| HIGH | {n} |
| MEDIUM | {n} |
### Tool Schema Issues
| Tool | Issue | Fix | Certainty |
### Structure Issues
| File | Issue | Certainty |
### Security Issues
| File | Line | Issue | Certainty || Category | Patterns | Certainty |
|---|---|---|
| Tool Schema | 5 | HIGH |
| Descriptions | 2 | HIGH |
| Schema Structure | 4 | MEDIUM |
| Plugin Structure | 3 | HIGH |
| MCP Patterns | 2 | MEDIUM |
| Security | 6 | HIGH/MEDIUM |
| Error Handling | 2 | MEDIUM |
| Tool Count | 1 | LOW |
| Total | 25 | - |
"description": "Search for things""description": "Search product catalog by keyword. Use for inventory or price queries. Returns products with prices."tools: Read, Bash # Unrestrictedtools: Read, Bash(git:*) # Scopedagent-docs/FUNCTION-CALLING-TOOL-USE-REFERENCE.mdagent-docs/CLAUDE-CODE-REFERENCE.mdagent-docs/OPENCODE-REFERENCE.mdagent-docs/CODEX-REFERENCE.md