plugin-audit

Audits vercel-plugin skill injection by testing hook matching against Claude Code conversation logs.

Updated Aug 21, 2025
One-click install
npx skills add https://github.com/Adithiya-S/AI-Study-Companion --skill plugin-audit-adithiya-s
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: plugin-audit
Source: https://github.com/Adithiya-S/AI-Study-Companion/tree/main/.agents/skills/plugin-audit
Command: npx skills add https://github.com/Adithiya-S/AI-Study-Companion --skill plugin-audit-adithiya-s

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? When a Claude Code plugin injects skills based on tool-call patterns, it is hard to know whether the matching rules actually fire on real-world usage. This Skill audits vercel-plugin performance by replaying actual conversation logs against the hook pipeline, revealing coverage gaps, dedup masking, and stale plugin caches. ## Core Features & Use Cases - Log Parsing: Extracts Read, Edit, Write, and Bash tool calls from Claude Code JSONL conversation logs. - Hook Match Testing: Imports the plugin's loadSkills and matchSkills functions directly to test pattern matching against real inputs without shelling out per call. - Gap & Staleness Analysis: Identifies path and Bash pattern gaps, dedup masking, budget drops, and diffs between the installed plugin cache and the dev version. - Use Case: After a long coding session on a Next.js project, run the batch-match script against the session's JSONL log to see which skills were injected, which were deduped, and which tool calls should have matched but did not. ## Quick Start Ask the AI to audit plugin skill injection on your project by analyzing the latest Claude Code conversation log and reporting match coverage gaps.

Frequently Asked Questions about plugin-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Claude Code plugin hook matching on real sessions?

Extract tool_use entries from the session's JSONL log, then call the plugin's matchSkills function directly with each tool name and input. The batch-match.mjs script automates this and outputs a match matrix and dedup timeline.

Where are Claude Code conversation logs stored?

Logs are stored as JSONL files under ~/.claude/projects/<encoded-project-path>/<session-id>.jsonl, where the encoded path replaces slashes with hyphens and prepends a leading hyphen.

Why did a skill not inject even though the file path should match?

Common causes include path pattern gaps in the skill's matching rules, dedup masking when the skill was already injected earlier in the session, or drops from the 12KB budget or 3-skill ceiling. The audit report categorizes each case.

How do I check if my installed plugin cache is stale?

Compare the cache at ~/.claude/plugins/cache/vercel-labs-vercel-plugin/vercel-plugin/<version>/ against the dev version by diffing skill pattern lines, and check installed_plugins.json for the installed version and git SHA.

Can I test the installed plugin cache instead of the dev hooks?

Yes, pass the --cache flag to batch-match.mjs. It resolves the highest-version install path from installed_plugins.json and imports the hook functions from the cache instead of the dev directory.