Production-grade plugin creator with nixtla-validated quality standards. 4 Agent Skills automate creating, validating, auditing, and versioning plugins in the claude-code-plugins marketplace

MIT License

Free Pricing

Installation

Open Claude Code and run this command:

/plugin install jeremy-plugin-tool@claude-code-plugins-plus

Use --global to install for all projects, or --project for current project only.

What It Does

Production-grade plugin creator with nixtla-validated quality standards - Includes 4 Agent Skills that automatically create, validate, audit, and version plugins for the claude-code-plugins marketplace.

![Version](.)

![Skills](.)

![Type](.)

![License: MIT](LICENSE)

Skills (4)

plugin-auditor SKILL.md View full skill →

'Audit automatically audits AI assistant code plugins for security vulnerabilities,.

ReadGrepBash(cmd:*)

Plugin Auditor

Name: jeremy-plugin-tool
Author: Claude Code Plugins

Overview

Audits Claude Code plugins for security vulnerabilities, best practices compliance, CLAUDE.md standards adherence, and marketplace readiness. Produces a scored audit report covering eight categories: security, best practices, CLAUDE.md compliance, marketplace compliance, git hygiene, MCP-specific checks, performance, and UX.

Prerequisites

Read access to the target plugin directory and repository-level .claude-plugin/marketplace.extended.json
jq installed for JSON schema validation
grep and find available on PATH for pattern scanning
Familiarity with the plugin structure defined in CLAUDE.md (.claude-plugin/plugin.json, README.md, LICENSE, component directories)

Instructions

Identify the target plugin path (e.g., plugins/security/plugin-name/). Confirm the directory exists and contains .claude-plugin/plugin.json.
Run a security scan across all plugin files (see ${CLAUDESKILLDIR}/references/audit-categories.md for full pattern list):

Search for hardcoded secrets, API keys, AWS access keys (AKIA...), and private key headers.
Detect dangerous commands (rm -rf /, eval(), exec()) and command injection vectors.
Flag suspicious URLs (non-HTTPS, raw IP addresses) and obfuscated code (base64 decode, hex encoding).

Validate plugin structure and best practices (see ${CLAUDESKILLDIR}/references/audit-process.md):

Confirm required files exist: plugin.json, README.md, LICENSE.
Verify semantic versioning format in plugin.json.
Check that all .sh scripts have execute permissions.
Scan for TODO/TODO comments without linked issues and console.log() in production code.

Check CLAUDE.md compliance:

Verify the plugin follows the directory structure specified in the repository CLAUDE.md.
Confirm plugin.json contains only allowed fields (name, version, description, author, repository, homepage, license, keywords).
Validate that hooks use ${CLAUDEPLUGINROOT} instead of hardcoded paths.

Verify marketplace compliance:

Confirm the plugin has an entry in marketplace.extended.json with matching name, version, category, and source path.
Check for duplicate plugin names in the catalog.

Assess git hygiene: no committed node_modules/, .env


                
                  
                  
                  plugin-creator
                  SKILL.md
                  View full skill →
                
                
                  'Create automatically creates new AI assistant code plugins with proper.
                  
                      WriteReadGrepBash(cmd:*)
                    
                
                
                  Plugin Creator
Overview
Scaffolds new Claude Code plugins with proper directory structure, required files, marketplace catalog integration, and full validation. Supports all plugin types: command plugins, agent plugins, skill plugins, MCP server plugins, and hybrid combinations.
Prerequisites

Write access to the plugins/ directory and .claude-plugin/marketplace.extended.json
jq installed for JSON generation and validation
pnpm run sync-marketplace available at the repository root
./scripts/validate-all-plugins.sh available for post-creation validation

Instructions

Gather requirements from the user request: plugin name (kebab-case), category (productivity, security, devops, testing, etc.), plugin type (commands, agents, skills, MCP, or combination), description, and keywords. Default author to the repository owner if unspecified (see ${CLAUDESKILLDIR}/references/plugin-creation-process.md).
Create the plugin directory structure under plugins/[category]/[plugin-name]/:


   plugins/[category]/[plugin-name]/
   ├── .claude-plugin/
   │   └── plugin.json
   ├── README.md
   ├── LICENSE
   └── [commands/ | agents/ | skills/ | hooks/ | mcp/]


Generate .claude-plugin/plugin.json using the template from ${CLAUDESKILLDIR}/references/file-templates.md. Populate all required fields: name, version (default 1.0.0), description, author (name and email), repository, license (default MIT), and keywords (minimum 2).
Generate README.md with installation instructions, usage examples, a description section, and contributor information.
Create a LICENSE file with MIT license text (or the specified license).
Generate component files based on the plugin type:


Commands: create commands/[command-name].md with proper YAML frontmatter (name, description, model).
Agents: create agents/[agent-name].md with YAML frontmatter including model field.
Skills: create skills/[skill-name]/SKILL.md with frontmatter (name, description, allowed-tools).
MCP: create package.json, tsconfig.json, src/index.ts, and .mcp.json.


Add the new plugin entry to .claude-plugin/marketplace.extended.json with matching name, version, category, description, source path, and keywords.
Ru


                
                  
                  
                  plugin-validator
                  SKILL.md
                  View full skill →
                
                
                  'Validate automatically validates AI assistant code plugin structure,.
                  
                      ReadGrepBash(cmd:*)
                    
                
                
                  Plugin Validator
Overview
Validates Claude Code plugin structure, JSON schemas, frontmatter format, security compliance, and marketplace catalog consistency. Runs the same checks as the CI pipeline to catch issues before committing.
Prerequisites

Read access to the target plugin directory and repository-level .claude-plugin/marketplace.extended.json
jq installed for JSON validation (jq empty )
grep and find available on PATH for pattern scanning
./scripts/validate-all-plugins.sh available at the repository root

Instructions

Identify the target plugin path from context or user request. Default to the current working directory if the path contains a .claude-plugin/ subdirectory.
Validate required files exist (see ${CLAUDESKILLDIR}/references/validation-checks.md):


.claude-plugin/plugin.json present and valid JSON.
README.md present and non-empty.
LICENSE file present.
At least one component directory exists (commands/, agents/, skills/, hooks/, or mcp/).


Validate plugin.json schema:


Confirm all required fields: name (kebab-case), version (semver x.y.z), description, author.name, author.email, license, keywords (array, minimum 2).
Reject any fields not in the allowed set (name, version, description, author, repository, homepage, license, keywords).


Validate frontmatter in all component files:


Commands (commands/*.md): require name, description, model (one of sonnet, opus, haiku).
Agents (agents/*.md): require name, description, model.
Skills (skills/*/SKILL.md): require name, description; allowed-tools optional but validated against the allowed tools list if present.


Validate directory structure matches the expected hierarchy (see ${CLAUDESKILLDIR}/references/validation-checks.md for the complete structure diagram).
Check script permissions: find all .sh files and verify they have execute permission. Report any that lack it with a fix command.
Run security scans: search for hardcoded secrets, AWS keys, private keys, dangerous commands, and susp


                
                  
                  
                  version-bumper
                  SKILL.md
                  View full skill →
                
                
                  'Execute automatically handles semantic version updates across plugin.
                  
                      ReadWriteEditGrepBash(cmd:*)
                    
                
                
                  Version Bumper
Overview
Automates semantic version bumps across all version-bearing files in a Claude Code plugin. Ensures consistency between plugin.json, marketplace.extended.json, and the generated marketplace.json catalog.
Prerequisites

jq installed and available on PATH for JSON manipulation
Read/write access to .claude-plugin/plugin.json and .claude-plugin/marketplace.extended.json
pnpm run sync-marketplace available at the repository root
Git installed for optional tag creation

Instructions

Identify the target plugin directory and read the current version from .claude-plugin/plugin.json using jq -r '.version'.
Determine the bump type (major, minor, or patch) from the user request. If unspecified, infer from the nature of changes: breaking changes warrant major, new features warrant minor, and fixes warrant patch.
Parse the current version into its major.minor.patch components and compute the new version according to semver rules (see ${CLAUDESKILLDIR}/references/version-bump-process.md).
Update the "version" field in .claude-plugin/plugin.json with the new version string.
Locate the plugin entry in .claude-plugin/marketplace.extended.json and update its "version" field to match (see ${CLAUDESKILLDIR}/references/update-locations.md).
Run pnpm run sync-marketplace at the repository root to regenerate marketplace.json.
Verify version consistency across all three files by reading each and confirming the version strings match.
Optionally create a git tag (git tag -a "vversion>" -m "Release vversion>") and prepare a commit message following the chore: Release v convention (see ${CLAUDESKILLDIR}/references/release-workflow.md).

Output
A version bump execution summary containing:

The computed transition (oldversion to newversion)
The exact files updated: .claude-plugin/plugin.json, .claude-plugin/marketplace.extended.json, and regenerated .claude-plugin/marketplace.json
Validation confirmation that all files carry the same version
Suggested next commands (git add, git commit, git tag, validation scripts)

Error Handling

          How It Works
          Just talk naturally while working on plugins!
Example Workflows
Workflow 1: Create New Plugin

You: "I need to create a new DevOps plugin called 'docker-optimizer' with commands"

Skills Powerkit automatically:
1. Recognizes "create new plugin" → Invokes Plugin Creator
2. Scaffolds plugins/devops/docker-optimizer/
3. Generates plugin.json, README, LICENSE, commands/
4. Adds to marketplace.extended.json
5. Syncs marketplace.json
6. Validates everything
7. Reports: "✅ Plugin created and ready!"

Workflow 2: Validate Before Commit

You: "Is my owasp-scanner plugin ready to commit?"

Skills Powerkit automatically:
1. Recognizes "ready to commit" → Invokes Plugin Validator
2. Checks plugin.json schema
3. Validates frontmatter
4. Verifies marketplace entry
5. Checks permissions
6. Reports: "✅ PASSED - Ready to commit!"

Workflow 3: Security Audit

You: "Security audit on the new password-manager plugin"

Skills Powerkit automatically:
1. Recognizes "security audit" → Invokes Plugin Auditor
2. Scans for hardcoded secrets
3. Checks dangerous commands
4. Validates security patterns
5. Generates audit report
6. Reports: "⚠️ Found 2 issues - no hardcoded credentials allowed"

Workflow 4: Release Management

You: "Bump docker-optimizer to minor version and update marketplace"

Skills Powerkit automatically:
1. Recognizes "bump to minor" → Invokes Version Bumper
2. Calculates new version (1.0.0 → 1.1.0)
3. Updates plugin.json
4. Recognizes "update marketplace" → Invokes Marketplace Manager
5. Updates marketplace.extended.json
6. Syncs marketplace.json
7. Reports: "✅ Version bumped to 1.1.0, marketplace updated"


        

          FAQ
          
  
      
      
        
Ensure you're in claude-code-plugins repository
Check you said trigger keywords ("create plugin", "validate", etc.)
Verify Skills Powerkit is installed: /plugin list

      
    

      
      
        
Run manually: npm run sync-marketplace
Check marketplace.extended.json syntax with jq
Verify no duplicate plugin names

      
    

      
      
        
Check error message for specific issue
Run: ./scripts/validate-all.sh plugins/your-plugin/
Fix reported issues


      
    



        

  Ready to use jeremy-plugin-tool?
  
    
    
        
        View on GitHub
      
  

          Related Plugins
          
            
                formatter
                Code formatting plugin using hooks to auto-format on save
              
                hello-world
                Simple example plugin demonstrating basic slash commands
              
                pi-pathfinder
                PI Pathfinder - Finds the path through 229 plugins. Automatically picks the best plugin for your task, extracts its skills, and applies them. You don't pick plugins, PI does. Part of our initiative to update all plugins with appropriate skill sets.
              
                security-agent
                Security review subagent for code analysis
              
          
        

          Tags
          
            skillsagent-skillsplugin-managementmarketplacevalidationauditversioningmeta-pluginrepository-tools
          
        

        
            
                Stay in the Loop
                
                    
                    
                    
                
                No spam. Unsubscribe anytime.
            

            
                
                    Product
                    
                        Explore
                        Skills
                        Cowork
                        Compare
                        Tools
                    
                
                
                    Resources
                    
                        Docs
                        Changelog
                        Collections
                        Playbooks
                        Research
                        Learning
                    
                
                
                    Company
                    
                        Community
                        Hall of Fame
                        GitHub
                    
                
                
                    Legal
                    
                        Privacy
                        Terms
                        Acceptable Use
                    
                
            

            
                Tons of Skills by Intent Solutions. Marine. Citadel Grad. 20 years ops → self-taught dev → AI architect.
                © 2026 Tons of Skills | Intent Solutions
            
        
    

Error
Cause
Solution


jq: command not found
jq not installed
Install via apt install jq or brew install jq