plugin-audit

Audits vercel-plugin skill injection by testing hook matching against Claude Code conversation logs.

Updated Sep 5, 2026
One-click install
npx skills add https://github.com/dsgalkar/dnyaneshwar_portfolio --skill plugin-audit-dsgalkar
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: plugin-audit
Source: https://github.com/dsgalkar/dnyaneshwar_portfolio/tree/main/.agents/plugins/vercel/.claude/skills/plugin-audit
Command: npx skills add https://github.com/dsgalkar/dnyaneshwar_portfolio --skill plugin-audit-dsgalkar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? When a Claude Code plugin injects skills based on tool calls, it is hard to know whether the right skills actually fired on real projects. This Skill audits vercel-plugin skill injection against real-world sessions, revealing pattern coverage gaps, dedup masking, and stale plugin caches. ## Core Features & Use Cases - Log-Based Tool Call Extraction: Parses JSONL conversation logs from ~/.claude/projects to extract Read, Edit, Write, and Bash tool calls with timestamps and working directories. - Direct Hook Matching Tests: Imports loadSkills and matchSkills from the plugin's hook pipeline to test matching in-process, avoiding slow per-call shell-outs. - Gap and Staleness Analysis: Identifies path pattern gaps, Bash pattern gaps, dedup masking, budget drops, and diffs between the installed plugin cache and the dev version. - Use Case: After noticing a Vercel deployment skill never triggered during a session, run the batch-match script against that session's JSONL log to see exactly which tool calls matched, which were deduped, and which patterns need to be added. ## Quick Start Ask the assistant to audit vercel-plugin skill injection on your project by analyzing the JSONL conversation log and reporting match coverage gaps.

Frequently Asked Questions about plugin-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test if Claude Code plugin hooks match my tool calls?

Run the batch-match.mjs script with the path to your session's JSONL log. It extracts Read, Edit, Write, and Bash tool calls, then calls the plugin's matchSkills function directly to report which skills matched, which were deduped, and which calls matched nothing.

Where are Claude Code conversation logs stored?

Logs are stored as JSONL files under ~/.claude/projects/, in a directory named after your project's absolute path with slashes replaced by hyphens and a leading hyphen. Each session gets its own .jsonl file containing message and tool_use entries.

Why is my skill not being injected even though the pattern should match?

Common causes include path or Bash pattern gaps, dedup masking where the skill was already injected earlier in the session, and drops from the 12KB budget or 3-skill ceiling. The audit report's match matrix and dedup timeline show exactly which case applies.

How do I check if my installed plugin cache is stale?

Compare the cache at ~/.claude/plugins/cache/ against the dev version by diffing the pattern lines in each skill's SKILL.md. Check ~/.claude/plugins/installed_plugins.json for the installed version and git SHA, or run batch-match.mjs with the --cache flag to test the cached hooks.

Can I test hook matching without running the hook script for each tool call?

Yes. Import loadSkills and matchSkills directly from the plugin's hooks/pretooluse-skill-inject.mjs module. Call loadSkills once, then matchSkills for each tool call, which is fast and produces exact match results without shelling out.