Claude Code Plugin Reference

Testrapport

Cloned the repo, confirmed frontmatter parses with name + a 158-char description, and spot-checked 13 cited files (check_plugin_hooks.py, validate_budget.py, hook_io.py, tdd_bdd_gate.py, marketplace.json, python39-compat.yml, ...) — all present; no curl|sh, base64, or injection text anywhere in the 511-line file. Install ran in a fresh mktemp HOME and landed SKILL.md at ~/.claude/skills/claude-code-plugin-reference/SKILL.md. Output test: I wrote a PreToolUse hook blocking `git commit --no-verify` twice, extracted both Python bodies, and ran them — baseline printed permissionDecision "block" (not one of allow/deny/ask) and exited 2, and it crashed with an uncaught JSONDecodeError (exit 1) on both `echo not-json` and empty stdin; the skill-followed version printed "deny", exited 0 in all three cases, and sent diagnostics to stderr. I also ran the repo's own gate against both manifests: `python3 scripts/check_plugin_hooks.py` rejected my baseline plugin.json (exit 1, "hooks array contains './hooks/hooks.json'") and accepted the skill-followed one (exit 0). Trigger phrasings — SHOULD load: "How do I register a PreToolUse hook in my plugin's hooks.json?", "My plugin hook isn't firing, it reads CLAUDE_TOOL_INPUT and gets nothing", "What frontmatter does a SKILL.md need and how does Skill(plugin:name) resolve?" — I would load it for all three. SHOULD NOT: "Run the test suite and publish 1.9.16 to the marketplace" (description's explicit "Do not use for ops" routes me to night-market-operations, even though a Marketplace section exists) and "Write a Python CLI that parses JSON from stdin" (no plugin context) — declined both. Docs docked one point: the body claims `"hooks": []` is "verified across all 23 manifests" but on disk only 11 of 23 carry the key and 12 omit it entirely (same effect, wrong wording), and the description's "used here" never names the repo, so a standalone installer gets night-market-only pointers (/sanctum:update-plugins, plugins/imbue, sibling night-market-* skills) mixed into portable harness facts. I could not run Python 3.9 locally, so the datetime.UTC / py39 claim is unverified by execution; every other claim I checked (herald's 10s registered vs 8s internal timeout, the vow_no_ai_attribution warn/block anomaly, DESCRIPTION_MAX = 160, hook_io's stdin-first docstring) matched the source exactly.

Testad: 2026-07-21 · Claude Code 2.x (agent harness)