verifier

Plugin verifier from marketplace verifier-mp in kazukinagata/analyzing-claude-plugin. Commands read from the repo's manifest — 1 month ago.

Skills (24)

• 00-canary

  Observation infrastructure canary. Verifies that plugin-level hooks fire (via session-start log), that skill frontmatter hooks register and fire after first invoke, and that bash tool subprocess can write to the findings directory. Run this BEFORE any other probe — if this FAILs, the verdict of ever

• 01-env-propagation

  Probe env propagation across 3 process tiers (§1.1). Compares which CLAUDE_* env vars are set in plugin-level hook vs skill frontmatter hook vs Bash tool subprocess.

• 02-substitution-allowlist

  Probe ${VAR} substitution allowlist in skill body (§1.2). Tests CLAUDE_PLUGIN_ROOT/DATA/SKILL_DIR/SESSION_ID/PROJECT_DIR substitution at invoke time.

• 03-shell-binsh

  Probe that hook commands run under /bin/sh (dash on WSL Ubuntu), not bash (§1.3). Bash-specific constructs should produce Bad substitution / syntax errors.

• 04-sensitive-leak

  Confirm that userConfig.api_secret (sensitive=true) is exposed as plain text via CLAUDE_PLUGIN_OPTION_API_SECRET in plugin-level hook env (§1.4). "sensitive" affects storage only, not runtime exposure.

• 05-userconfig-trigger

  Probe userConfig prompt trigger rules (§1.5). Manual verification of 4 routes — install/enable silent, /plugins UI prompt, disable→enable conditional, hook error when referenced-but-unset.

• 06-marketplace-cache

  Compare CLAUDE_PLUGIN_ROOT with the marketplace cache path (§1.6). Docs say plugins run from cache; observation showed they run from source. This probe lets you classify the current behavior as PASS (finding holds) or DOC-ALIGNED (cache is now used).

• 07-skill-body-subst

  §1.7. Skill body ${VAR} substitution happens at invoke time only — reading the SKILL.md via Read tool returns literal placeholders.

• 08-frontmatter-timing

  §1.8. Skill frontmatter hook registers AFTER first invoke. SessionStart + once:true does not fire. Self-block during own load is impossible.

• 08b-self-block-attempt

  Companion to 08. Tests whether a skill's own frontmatter hook can block its own load (it cannot — frontmatter hooks register AFTER load).

• 09-slash-vs-natural

  §1.9. Slash invocation does NOT trigger PreToolUse:Skill; natural-language invocation does. UserPromptExpansion fires for slash only.

• 10-parallel-hook-firing

  §1.10. Verify that hooks within the same array fire in parallel. parallel-a (200ms sleep), parallel-b (400ms sleep), parallel-c (0ms) on SessionStart should produce overlapping start_ns timestamps; finish order should be c < a < b (parallel) not a < b < c (serial).

• 11-block-target

  §2.4. Target skill for the block pair (11+12). After 12-block-self is invoked (registering its frontmatter PreToolUse:Skill hook), invoking 11-block-target should be blocked.

• 12-block-self

  §2.4 / §2.5. Self-blocker skill. Its frontmatter PreToolUse:Skill hook returns a JSON block decision for any Skill tool call to 11-block-target. Must be invoked BEFORE 11-block-target so the hook is registered.

• 13-cowork-pretooluse

  Cowork plugin-level PreToolUse never fires (block ignored) and bash tool is named mcp__workspace__bash (research sections 2.4 and 2.5). CLI baseline confirms block fires for the Bash matcher.

• 14-cowork-parser

  Cowork hook command parser is restricted to an echo+bash whitelist; CLI uses /bin/sh. This probe reads the parser-tests.log emitted by a parser-test hook variant.

• 15-cowork-file-io

  §2.7. In Cowork, hook side effects (file writes) don't reach the shell sandbox. Only stdout/additionalContext flows through. This probe writes a canary file from a hook (via the inline command below) then tries to read it from Bash tool.

• 16-cowork-path-forms

  CLAUDE_PLUGIN_ROOT and CLAUDE_PLUGIN_DATA take three different forms across contexts in Cowork (Windows, MSYS, Linux mount); CLI baseline is a single Linux path (research sections 2.8 and 7.9).

• 17-cowork-bash-mount

  Cowork mounts the plugin install dir under /sessions/CODENAME/mnt/.remote-plugins/ read-only. Bundled scripts can be launched via relative path; CLAUDE_SKILL_DIR expands to a Windows path that fails directly. CLI baseline lets both patterns work. See research section 2.10.

• 18-cowork-data-isolation

  §2.11 / §2.12. CLI shares CLAUDE_PLUGIN_DATA across sessions; Cowork isolates it per chat session. ROOT remains the same across sessions in both. CLAUDE_CODE_REMOTE is empty in both.

• 19-cowork-resume

  §2.1. Cowork re-fires SessionStart with source=resume after VM suspend. Skill frontmatter hooks reset across the resume. CLI baseline never resumes within one process.

• 20-cowork-validation

  CLI validates plugins fully; Cowork reports a generic Plugin validation failed without exposing the cause (research section 2.3). Runs claude plugin validate on isolated violator variants.

• 21-cowork-connected-folder

  §2.9. Cowork sandbox limits write/edit/bash to outputs/ by default; plugin dir is read-only; request_cowork_directory grants RW to arbitrary host folders.

• 22-substitution-frontmatter

  Single-quote isolation probe to fill team-report §1.2 unverified cells. Tests Claude Code pre-substitution in plugin-level hook + skill frontmatter hook + skill body for SESSION_ID, PROJECT_DIR, SKILL_DIR, and user_config.KEY.

Hooks (12)

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/log.sh" session-start

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/parallel-a.sh"

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/parallel-b.sh"

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/parallel-c.sh"

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/subst-probe.sh" plugin SESSION_ID '${CLAUDE_SESSION_ID}'

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/subst-probe.sh" plugin SKILL_DIR '${CLAUDE_SKILL_DIR}'

• SessionStart

  "${CLAUDE_PLUGIN_ROOT}/hooks/subst-probe.sh" plugin USER_CONFIG '${user_config.hello_message}'

• UserPromptSubmit

  "${CLAUDE_PLUGIN_ROOT}/hooks/log.sh" user-prompt-submit

• UserPromptExpansion

  "${CLAUDE_PLUGIN_ROOT}/hooks/log.sh" user-prompt-expansion

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/log.sh" pretool-bash

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/log.sh" pretool-skill

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}/hooks/log.sh" pretool-mcp-workspace-bash