a0-review-plugin
Full audit of Agent Zero plugins in usr/plugins/. Reviews manifest validity, directory structure, code patterns (Store Gating, notifications, imports), security, and duplicate detection against the community index. Use when asked to review, audit, validate, or check an existing plugin before using or contributing it.
Best for Plugin authorsWorks with GitHubLow risk
⌘source
- author
@agent0ai- language
- Python
★17kstars
3.6kforks
May 2, 2026
✦overview.md
Key Features
- ·Validates plugin manifest YAML
- ·Checks directory structure and imports
- ·Detects security vulnerabilities
- ·Duplicates check against community index
- ·Reports findings grouped by phase
Use Cases
- →Before submitting a plugin to the community index
- →When troubleshooting a malfunctioning plugin
- →During code review of a new plugin contribution
- →To verify plugin security compliance
Best for
- ✓Plugin authors
- ✓Community maintainers
- ✓QA reviewers
Not ideal for
- !Non-plugin code audits
- !Runtime performance analysis
FAQs
name
a0-review-plugin
description
Full audit of Agent Zero plugins in usr/plugins/. Reviews manifest validity, directory structure, code patterns (Store Gating, notifications, imports), security, and duplicate detection against the community index. Use when asked to review, audit, validate, or check an existing plugin before using or contributing it.
version:1.0.0
tags:["plugins","review","audit","validate","security","checklist"]
trigger_patterns:["review plugin","audit plugin","validate plugin","check plugin","plugin review","is my plugin correct","plugin checklist"]
Agent Zero Plugin Review
Full-audit workflow for plugins in /a0/usr/plugins/<name>/. Run all 4 phases in order and report findings grouped by phase. Mark each item PASS, FAIL, or WARN.
For detailed checklists and code pattern references, read checklists.md in this skill directory when needed.
Phase 1: Manifest Validation
Read usr/plugins/<name>/plugin.yaml. Check:
- File exists at plugin root
- Valid YAML (parseable, mapping at top level)
-
namefield handling matches the intended distribution target: for community / Plugin Index plugins it must be present, non-empty, match^[a-z0-9_]+$, and match the directory name; for local-only plugins, a missingnameis a WARN rather than a FAIL -
titlepresent and non-empty -
descriptionpresent and non-empty -
versionpresent, follows semver or simplex.y.zformat -
settings_sectionsis a list; each value is one of:agent,external,mcp,developer,backup -
per_project_configandper_agent_configare booleans (if present) -
always_enabledisfalseor absent (only framework core plugins should usetrue)
$install
1-click copynpx skills add agent0ai/agent-zero --skill a0-review-pluginSafety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
5/ 5
excellentVery clear and well structured, with almost no room for misunderstanding.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
5/ 5
very highHighly actionable with clear, concrete steps that an agent can follow directly.