The original title is: "A plugin can pass validation and still fail after install"

Short summary

A technical deep-dive into five ways plugin packages can pass manifest validation but still fail after installation, targeting both Codex and Claude Code harnesses. Covers issues like missing files in npm tarballs, version mismatches across harnesses, external symlinks, marketplace source resolution, and incomplete Agent Skill frontmatter. The author introduces PluginProof, an open-source CLI tool that performs structural validation without executing plugin code.

• •Five failure modes that survive basic manifest validation for Codex and Claude Code plugins
• •PluginProof tool checks cross-harness packaging, file coverage, and skill frontmatter
• •Open-source (MIT) on Codeberg; supports CI integration with --check flag
• •Does not execute plugin code — purely structural analysis

Generated with AI, which can make mistakes.