claude-plugins-validation

不要把试用当真实运行

试用 Prompt 只展示流程，不证明项目已安装或运行。

确认宿主兼容

支持 MCP 的 AI 宿主、claude_code、claude

先隔离验证

继续完成沙箱验证和证据复核

失败模式：security_permissions: Canonical pre-push hook: strict publish-ancestry gate forbids ALL branch sharing — allow non-...

需要继续复核。

Developers may expose sensitive permissions or credentials: Canonical pre-push hook: strict publish-ancestry gate forbids ALL branch sharing — allow non-default-branch pushes after secret scan (fleet-stall root cause)

失败模式：security_permissions: skillaudit:agent_manipulation MCP_SCHEMA_POISON false-positive on wikimem memory-note descrip...

需要继续复核。

Developers may expose sensitive permissions or credentials: skillaudit:agent_manipulation MCP_SCHEMA_POISON false-positive on wikimem memory-note description: PROSE (same class as #177 / #156)

失败模式：security_permissions: standardize still strips documented linter suppressions (MD010、CKV_DOCKER_2) — #145 fixed on...

需要继续复核。

Developers may expose sensitive permissions or credentials: standardize still strips documented linter suppressions (MD010、CKV_DOCKER_2) — #145 fixed only MD025; and canon publish.py never creates the {name}--v{version} resolver tag

来源证据：Canonical-pipeline validate step hangs ~30 min AFTER CPV builds (4s) — not #114's cold-build cause; timed-out release s…

GitHub 社区证据显示该项目存在一个安全/权限相关的待验证问题：Canonical-pipeline validate step hangs ~30 min AFTER CPV builds (4s) — not #114's cold-build cause; timed-out release shipped with no assets

可能影响授权、密钥配置或安全边界。

失败模式：installation: Canonical-pipeline validate step hangs ~30 min AFTER CPV builds (4s) — not #114's cold-build...

需要继续复核。

Developers may fail before the first successful local run: Canonical-pipeline validate step hangs ~30 min AFTER CPV builds (4s) — not #114's cold-build cause; timed-out release shipped with no assets

失败模式：installation: Scan dependencies (not just the plugin tree) for agent-context writers、and score capability...

需要继续复核。

Developers may fail before the first successful local run: Scan dependencies (not just the plugin tree) for agent-context writers、and score capability vs live separately

失败模式：installation: feat(canonical-pipeline): gate Rust + shell when a plugin ships them (regen drops them silently)

需要继续复核。

Developers may fail before the first successful local run: feat(canonical-pipeline): gate Rust + shell when a plugin ships them (regen drops them silently)

失败模式：installation: skillaudit:filesystem FS_WRITE false-positive on install-doc PROSE (bash comment naming ~/.zs...

需要继续复核。

Developers may fail before the first successful local run: skillaudit:filesystem FS_WRITE false-positive on install-doc PROSE (bash comment naming ~/.zshrc)

失败模式：installation: v2.158.0: the #165 resolver-tag migration SILENTLY skips 6/13 fleet plugins (anchor regex mis...

需要继续复核。

Developers may fail before the first successful local run: v2.158.0: the #165 resolver-tag migration SILENTLY skips 6/13 fleet plugins (anchor regex misses the two-call push shape); residual signal is a non-blocking WARNING; its remedia...

可能修改宿主 AI 配置

项目面向 Claude/Cursor/Codex/Gemini/OpenCode 等宿主，或安装命令涉及用户配置目录。

安装可能改变本机 AI 工具行为，用户需要知道写入位置和回滚方法。

失败模式：configuration: CC v2.1.207 spec drift: ${user_config.*} in shell-form commands is now REJECTED、and plugin o...

需要继续复核。

Developers may misconfigure credentials、environment、or host setup: CC v2.1.207 spec drift: ${user_config.*} in shell-form commands is now REJECTED、and plugin options are no longer read from project settings.json — CPV has no rule for either

失败模式：configuration: RC-DEP-TAG-PIPELINE false-positives on a correct (manifest-derived) resolver tag — the litera...

需要继续复核。

Developers may misconfigure credentials、environment、or host setup: RC-DEP-TAG-PIPELINE false-positives on a correct (manifest-derived) resolver tag — the literal never appears in publish.py