I built an audit plugin to audit Claude Code plugins

Claude Code’s plugin system is incredibly powerful, but it’s easy to lose track of what’s actually running in your environment. After a week of adding marketplace tools and writing custom local agents, I ran into two issues:

1. 
   Command Amnesia: Forgetting the exact names of tools and how to invoke them.


2. 
   Hidden Hooks: Not knowing which plugins registered PostToolUse hooks or high-risk permissions like raw Bash access.

To solve this, I built plugin-audit — a tool designed to give you a clear inventory and security overview of your workspace.

🛠️ The Commands

The plugin provides a complete toolkit to bring transparency to your setup:

• 
  /audit: The global scan. Lists every command, skill, agent, and hook in a clean table.


• 
  /audit-risk: Heuristic scoring for permissions (e.g., Critical for Bash, Low for Read).


• 
  /audit-diff: Snapshot comparison to see exactly what changed after adding a new plugin.


• 
  /audit-help <name>: Get the detailed metadata for a specific capability (very useful for debugging hooks).

🚀 Example Output

📦 Quick Start

Install it via the marketplace directly in Claude Code:

/plugins marketplace add nestedcat/nestedcat-claude-marketplace

/plugins install plugin-audit@nestedcat-claude-marketplace

Check out the source on GitHub:

👉 https://github.com/nestedcat/plugin-audit

How many plugins are you currently running?