The latest articles on DEV Community by nestedcat (@nestedcat). https://dev.to/nestedcat https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3791132%2F82f2fac5-dce3-4a88-8f28-fba75e5fb5b3.png https://dev.to/nestedcat en nestedcat Wed, 25 Feb 2026 11:26:08 +0000 https://dev.to/nestedcat/i-built-an-audit-plugin-to-audit-claude-code-plugins-4oon https://dev.to/nestedcat/i-built-an-audit-plugin-to-audit-claude-code-plugins-4oon <p>Claude Code’s plugin system is incredibly powerful, but it’s easy to lose track of what’s actually running in your environment. After a week of adding marketplace tools and writing custom local agents, I ran into two issues:</p> <ol> <li> <strong>Command Amnesia:</strong> Forgetting the exact names of tools and how to invoke them.</li> <li> <strong>Hidden Hooks:</strong> Not knowing which plugins registered <code>PostToolUse</code> hooks or high-risk permissions like raw <code>Bash</code> access.</li> </ol> <p>To solve this, I built <strong><code>plugin-audit</code></strong> — a tool designed to give you a clear inventory and security overview of your workspace.</p> <h3> 🛠️ The Commands </h3> <p>The plugin provides a complete toolkit to bring transparency to your setup:</p> <ul> <li> <strong><code>/audit</code></strong>: The global scan. Lists every command, skill, agent, and hook in a clean table.</li> <li> <strong><code>/audit-risk</code></strong>: Heuristic scoring for permissions (e.g., Critical for <code>Bash</code>, Low for <code>Read</code>).</li> <li> <strong><code>/audit-diff</code></strong>: Snapshot comparison to see exactly what changed after adding a new plugin.</li> <li> <strong><code>/audit-help &lt;name&gt;</code></strong>: Get the <strong>detailed metadata</strong> for a specific capability (very useful for debugging hooks).</li> </ul> <h3> 🚀 Example Output </h3> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Name</th> <th>Type</th> <th>Source</th> <th>Provider</th> <th>Invocation</th> </tr> </thead> <tbody> <tr> <td>frontend-design</td> <td>skill</td> <td>plugin:frontend-design</td> <td>claude-plugins-official</td> <td>Auto-triggered by model</td> </tr> <tr> <td>setup_semgrep_plugin</td> <td>command</td> <td>plugin:semgrep-plugin</td> <td>claude-plugins-official</td> <td><code>/setup_semgrep_plugin</code></td> </tr> <tr> <td>code-review</td> <td>command</td> <td>plugin:code-review</td> <td>claude-plugins-official</td> <td><code>/code-review</code></td> </tr> <tr> <td>code-simplifier</td> <td>agent</td> <td>plugin:code-simplifier</td> <td>claude-plugins-official</td> <td>Use code-simplifier agent</td> </tr> <tr> <td>revise-claude-md</td> <td>command</td> <td>plugin:claude-md-management</td> <td>claude-plugins-official</td> <td><code>/revise-claude-md</code></td> </tr> <tr> <td>audit</td> <td>command</td> <td>plugin:plugin-audit</td> <td>nestedcat-claude-marketplace</td> <td><code>/audit</code></td> </tr> <tr> <td>PostToolUse:Write/Edit</td> <td>hook</td> <td>plugin:semgrep-plugin</td> <td>claude-plugins-official</td> <td>Auto-trigger</td> </tr> <tr> <td>planner</td> <td>agent</td> <td>user</td> <td>—</td> <td>Use planner agent</td> </tr> <tr> <td>tdd-guide</td> <td>agent</td> <td>user</td> <td>—</td> <td>Use tdd-guide agent</td> </tr> </tbody> </table></div> <h3> 📦 Quick Start </h3> <p>Install it via the marketplace directly in Claude Code:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>/plugins marketplace add nestedcat/nestedcat-claude-marketplace /plugins install plugin-audit@nestedcat-claude-marketplace </code></pre> </div> <p>Check out the source on GitHub:<br> 👉 <a href="https://github.com/nestedcat/plugin-audit" rel="noopener noreferrer">https://github.com/nestedcat/plugin-audit</a></p> <p>How many plugins are you currently running? </p> ai claude plugins python nestedcat Wed, 25 Feb 2026 11:17:23 +0000 https://dev.to/nestedcat/i-built-an-audit-plugin-to-audit-claude-code-plugins-2hlg https://dev.to/nestedcat/i-built-an-audit-plugin-to-audit-claude-code-plugins-2hlg <p>Claude Code’s plugin system is incredibly powerful, but it’s easy to lose track of what’s actually running in your environment. After a week of adding marketplace tools and writing custom local agents, I ran into two issues:</p> <ol> <li> <strong>Command Amnesia:</strong> Forgetting the exact names of tools and how to invoke them.</li> <li> <strong>Hidden Hooks:</strong> Not knowing which plugins registered <code>PostToolUse</code> hooks or high-risk permissions like raw <code>Bash</code> access.</li> </ol> <p>To solve this, I built <strong><code>plugin-audit</code></strong> — a tool designed to give you a clear inventory and security overview of your workspace.</p> <h3> 🛠️ The Commands </h3> <p>The plugin provides a complete toolkit to bring transparency to your setup:</p> <ul> <li> <strong><code>/audit</code></strong>: The global scan. Lists every command, skill, agent, and hook in a clean table.</li> <li> <strong><code>/audit-risk</code></strong>: Heuristic scoring for permissions (e.g., Critical for <code>Bash</code>, Low for <code>Read</code>).</li> <li> <strong><code>/audit-diff</code></strong>: Snapshot comparison to see exactly what changed after adding a new plugin.</li> <li> <strong><code>/audit-help &lt;name&gt;</code></strong>: Get the <strong>detailed metadata</strong> for a specific capability (very useful for debugging hooks).</li> </ul> <h3> 🚀 Example Output </h3> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Name</th> <th>Type</th> <th>Source</th> <th>Provider</th> <th>Invocation</th> </tr> </thead> <tbody> <tr> <td>frontend-design</td> <td>skill</td> <td>plugin:frontend-design</td> <td>claude-plugins-official</td> <td>Auto-triggered by model</td> </tr> <tr> <td>setup_semgrep_plugin</td> <td>command</td> <td>plugin:semgrep-plugin</td> <td>claude-plugins-official</td> <td><code>/setup_semgrep_plugin</code></td> </tr> <tr> <td>code-review</td> <td>command</td> <td>plugin:code-review</td> <td>claude-plugins-official</td> <td><code>/code-review</code></td> </tr> <tr> <td>code-simplifier</td> <td>agent</td> <td>plugin:code-simplifier</td> <td>claude-plugins-official</td> <td>Use code-simplifier agent</td> </tr> <tr> <td>revise-claude-md</td> <td>command</td> <td>plugin:claude-md-management</td> <td>claude-plugins-official</td> <td><code>/revise-claude-md</code></td> </tr> <tr> <td>audit</td> <td>command</td> <td>plugin:plugin-audit</td> <td>nestedcat-claude-marketplace</td> <td><code>/audit</code></td> </tr> <tr> <td>PostToolUse:Write/Edit</td> <td>hook</td> <td>plugin:semgrep-plugin</td> <td>claude-plugins-official</td> <td>Auto-trigger</td> </tr> <tr> <td>planner</td> <td>agent</td> <td>user</td> <td>—</td> <td>Use planner agent</td> </tr> <tr> <td>tdd-guide</td> <td>agent</td> <td>user</td> <td>—</td> <td>Use tdd-guide agent</td> </tr> </tbody> </table></div> <h3> 📦 Quick Start </h3> <p>Install it via the marketplace directly in Claude Code:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>/plugins marketplace add nestedcat/nestedcat-claude-marketplace /plugins <span class="nb">install </span>plugin-audit@nestedcat-claude-marketplace </code></pre> </div> <p>Check out the source on GitHub:<br> 👉 <a href="https://github.com/nestedcat/plugin-audit" rel="noopener noreferrer">https://github.com/nestedcat/plugin-audit</a></p> <p>How many plugins are you currently running? </p> ai claude plugins python