plugin-audit

Plugin Audit

Auto-detect installed plugins from disk, classify into 8 fixed functional buckets, flag overlaps, and produce a Keep/Review/Disable recommendation for every item. No input required from the user.

Step 1 — Auto-detect installed plugins

Before asking the user for anything, attempt to read the plugin cache directory:

• Windows: %USERPROFILE%\.claude\plugins\cache\
• Mac/Linux: ~/.claude/plugins/cache/

Use the Glob tool with pattern **/.claude-plugin/plugin.json under the cache root. This finds every installed plugin's manifest.

For each manifest found:

• Extract {namespace}/{name} from the file path (two directories above .claude-plugin/)
• Read the description and name fields from the JSON for classification signal

If Glob returns zero results, try the pattern */*/ directly under the cache root to get namespace/name folder pairs without reading manifests. Use folder names as the only signal.

If cache path does not exist or is entirely empty: Tell the user:

"Could not find the plugin cache at the expected path. Please paste your installed plugin list (one per line, e.g. claude-mem@thedotmack)." Then proceed with the pasted input.

Partial list: If you detect a total count mismatch (e.g. the user mentions "20 plugins" but you found only 15 folders), say so explicitly: "Found 15 of 20 plugins in cache — 5 may be in a non-standard location. Classifying what was found."

Step 2 — Classify into buckets

Assign every plugin to exactly one PRIMARY bucket from the fixed list below. Use the plugin's name + description as signal. If a plugin meaningfully spans two buckets, assign the primary and note the secondary in parentheses.

If a plugin has no usable signal from name or description, place it in Unclassified with a note.

Do NOT invent new buckets. If an item genuinely fits none, flag it as Unclassified.

The 8 buckets

#	Bucket	Classification signals
1	Memory & Context Persistence	memory, mem, episodic, recall, persistent, context store, session
2	Knowledge & Docs Retrieval	docs, context7, library, reference, RAG, search, documentation
3	Code Quality & Review	review, lint, simplify, refactor, security, audit, pr, quality
4	Feature Development & Workflow	feature, dev, commit, workflow, plan, superpowers, TDD, build, orchestrate
5	Setup, Config & Project Management	setup, config, md-management, init, scaffold, serena, intelligence, symbol
6	Design & Frontend	frontend, design, ui, ux, component, figma, css, visual
7	Integrations & External Apps	github, slack, linear, gmail, jira, MCP connector, external service name
8	Experimental / Personal / Misc	personal name in namespace, persona, novelty, grab-bag bundle, single-author

Keep / Review / Disable rules

Apply exactly one recommendation to every item:

• Keep — distinct function, no redundancy with another Keep item, likely used regularly.
• Review — overlaps with another item in the same bucket, or unclear if still actively used. User decides.
• Disable — confirmed redundant (same role as a Keep item from same bucket), one-time-use already completed, or niche enough that it adds more context noise than value.

Opinionated ceiling: Most working stacks land at 5–8 active plugins. Beyond that, active plugins inject redundant instructions into every conversation, degrading response quality. State this ceiling in the hygiene summary so the user can override if they disagree.

Duplication rule: If two plugins have the same name installed from different sources (namespaces), one is a duplicate — recommend Disable for the one with lower install count or the marketplace copy if an official copy exists.

Step 3 — Produce output

Chat output (always)

# Plugin Inventory — {today's date}

**Total classified:** N of M  ← note any missing items

## Memory & Context Persistence
- `plugin-id` — one-line function. **[Keep | Review | Disable]** — short reason.
  - ⚠️ Overlaps with `other-plugin-id` (both do X)

[...repeat for every non-empty bucket, in the order listed above...]

## Unclassified
- `plugin-id` — needs a lookup (no usable signal from name or description).

---

## Hygiene summary
- **Overlaps to resolve:** [list pairs]
- **Confirmed duplicates:** [list]
- **Candidates to disable:** [list]
- **Suggested core set (N active):** [list the Keep items]

Report saved to: {resolved path}

Only include buckets that have at least one item. Skip empty buckets.

File output (always)

Save the full report to:

• Windows: %USERPROFILE%\.claude\plugin-audit-report.md
• Mac/Linux: ~/.claude/plugin-audit-report.md

Overwrite on every run — always fresh. Use the Write tool. Tell the user the resolved absolute path at the end of the chat output.

Worked example

Input: auto-detected from plugin cache (20 plugins found)

# Plugin Inventory — 2026-06-04

**Total classified:** 20 of 20

## Memory & Context Persistence
- `claude-mem` — captures session activity, compresses, replays on restart. **Keep** — strongest memory option.
  - ⚠️ Overlaps with `episodic-memory` (both persist cross-session context)
- `episodic-memory` — stores discrete session episodes for recall. **Review** — overlaps with claude-mem; pick one.

## Knowledge & Docs Retrieval
- `context7` — injects up-to-date library docs on demand. **Keep** — no overlap, high value for library work.

## Code Quality & Review
- `code-review` — structured review pass on diffs/PRs. **Keep**.
- `code-simplifier` — refactors toward simpler, cleaner code. **Keep** — distinct from review; catches complexity, not bugs.
- `pr-review-toolkit` — PR-specific review workflow with inline comments. **Keep** — distinct scope from general code review.
- `security-guidance` — dedicated security lens for code and architecture. **Keep** — distinct from general review.

## Feature Development & Workflow
- `feature-dev` — multi-step feature build workflow (plan → TDD → commit). **Keep**.
- `superpowers@claude-plugins-official` — workflow orchestration: planning, TDD, commits, PRs, subagents. **Keep**.
- `superpowers@superpowers-marketplace` — workflow orchestration. **Disable** ⚠️ DUPLICATE — exact same role as `superpowers@claude-plugins-official`; two instances installed from different sources.
- `skill-creator` — builds, benchmarks, and optimizes new skills. **Review** — keep only if actively building skills.
- `superpowers-developing-for-claude-code` — tooling for Claude Code plugin authors. **Disable** — niche; only relevant when building plugins for the marketplace.

## Setup, Config & Project Management
- `claude-code-setup` — automates assistant/environment configuration. **Review** — one-time use; safe to disable after initial setup is complete.
- `claude-md-management` — maintains CLAUDE.md / rules files. **Keep**.
- `serena` — semantic code intelligence, symbol lookup, project navigation. **Keep** — distinct from all others; no overlap.

## Design & Frontend
- `frontend-design` — UI/component generation with design system guidance. **Keep**.
- `ui-ux-pro-max` — advanced UI/UX generation. **Review** ⚠️ overlaps with `frontend-design`; pick the one that better fits your stack and disable the other.

## Integrations & External Apps
- `github` — GitHub integration: issues, PRs, repos. **Keep**.

## Experimental / Personal / Misc
- `caveman` — ultra-compressed communication mode, cuts ~75% tokens. **Keep** — measurable token value; distinct from all other buckets.
- `andrej-karpathy-skills` — single-author skill bundle. **Review** — audit the sub-skills inside; disable the bundle if you only use one or two of them.

---

## Hygiene summary
- **Overlaps to resolve:** `claude-mem` vs `episodic-memory` (memory); `frontend-design` vs `ui-ux-pro-max` (design)
- **Confirmed duplicates:** `superpowers` installed twice — disable `superpowers@superpowers-marketplace`
- **Candidates to disable:** `superpowers@superpowers-marketplace`, `superpowers-developing-for-claude-code`
- **Suggested core set (12 active):** claude-mem, context7, code-review, code-simplifier, pr-review-toolkit, security-guidance, feature-dev, superpowers@official, claude-md-management, serena, frontend-design, github

Report saved to: C:\Users\YourName\.claude\plugin-audit-report.md