obsidian-plugin-agent-kitCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

# Personal, available in every project
cp -r skills/audit-obsidian-plugin ~/.claude/skills/

# Or per project
cp -r skills/audit-obsidian-plugin .claude/skills/

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: audit-obsidian-plugin
description: Audit an Obsidian plugin against the Obsidian developer policies, the submission requirements for the Community directory, and plugin-security / performance anti-patterns. Reports violations by severity and can auto-fix most of them after approval. Also covers releasing: the community.obsidian.md submission process, the policy on installing dependencies, release-tag and leaked-secret traps, and driving a real Obsidian over the debugging protocol to verify runtime behaviour and record README screenshots and demo GIFs. Use when preparing an Obsidian plugin for submission or release, when responding to review feedback, when recording plugin demos, or whenever the user asks to "review", "audit", "lint", or "check" an Obsidian plugin.
version: 2.0.0
author: Claude Code
category: obsidian
---

# Audit Obsidian Plugin

Mechanical review of an Obsidian plugin against the official submission rules, ObsidianReviewBot feedback patterns, and Electron-specific performance/memory anti-patterns. Produces a categorized findings report and can apply safe auto-fixes.

## When to invoke

- Before submitting to the Obsidian Community directory at community.obsidian.md
- When preparing a release, or recording README screenshots and demo GIFs
- Responding to ObsidianReviewBot comments on an existing PR
- After finishing a large feature, before merging
- When the user asks to "review", "audit", "lint", or "check" an Obsidian plugin
- When the user mentions tech debt, memory leaks, or performance issues in an Obsidian plugin

## Workflow

Run phases in order. Do not skip phases. Each phase writes findings to the running report.

### Phase 0 — Scope discovery

1. Locate `manifest.json` at repo root. If missing, stop and tell the user this is not an Obsidian plugin root.
2. Read `manifest.json`, `package.json`, `tsconfig.json`, `versions.json`, `styles.css`, `.gitignore`, `LICENSE`.
3. Note the source roots (`main.ts`, `src/`), the build output paths, and whether tests exist.
4. Announce in one sentence what will be audited.

### Phase 1 — Run checks in parallel

Use `Grep` for each rule in [reference/rule-catalog.md](./reference/rule-catalog.md). Group grep calls in parallel batches of ~10 to avoid serialization. Do NOT use `cat`, `find`, or `ls` — use `Grep`, `Glob`, `Read`.

Scan only source files: `main.ts`, `src/**/*.ts`, `src/**/*.tsx`. Ignore `node_modules/`, `main.js`, `dist/`, `build/`, `Test Vault/`.

For each rule that matches, record: rule code, severity, file:line, snippet, suggested fix. Count matches but cap reported instances per rule at 20 (note "+N more" if truncated).

### Phase 2 — Severity ranking

- **BLOCKER** — will fail the submission PR bot (manifest, id/name rules, innerHTML, var, process.platform, fetch-for-CORS, remote code eval, missing LICENSE).
- **MAJOR** — will get requested fixes from human reviewer (inline styles, `console.log`, `any`, floating promises, `detachLeavesOfType` in onunload, heading elements in settings, default hotkeys, casting instead of `instanceof`).
- **MINOR** — style / consistency (sentence case, unused imports, unused vars, tooltip via setAttribute, settings-tab top heading).
- **PERF** — runtime cost (chained `.filter` on large collections, `Promise.all` without batch cap, full re-renders, per-item async in loops, pretty-printed JSON on disk, `Array.from` with no reason).
- **DEBT** — maintainability (files > 300 lines with no module split, duplicated logic, `enhanced_/v2_/new_` naming, copy-pasted blocks).
- **BMC** — Buy Me A Coffee integration (description page, settings page, correct id `<FUNDING_HANDLE>`, no security/perf regressions from the donate widget). Severities mapped per rule in the catalog.

### BMC check (Phase 1 sub-pass)

Canonical identities, from identity.json — the two are DIFFERENT handles:
- Author (GitHub attribution): `<AUTHOR_HANDLE>` → `https://github.com/<AUTHOR_HANDLE>` (used in `manifest.json#author`, `manifest.json#authorUrl`, `package.json#author`, LICENSE copyright).
- BMC (funding): `<FUNDING_HANDLE>` → `https://www.buymeacoffee.com/<FUNDING_HANDLE>` (used in `manifest.json#fundingUrl`, README badge, settings tab support section).

Flag as a violation (MAN-022) if `<FUNDING_HANDLE>` leaks into the `author`/`authorUrl` fields, or if `<AUTHOR_HANDLE>` ends up in a BMC link.

Always run this pass after the main grep pass. It needs to cross-reference three surfaces:

1. `manifest.json` — look for `fundingUrl`; confirm host/path point at `buymeacoffee.com/<FUNDING_HANDLE>`. Also verify `author`=`<AUTHOR_HANDLE>` and `authorUrl`=`https://github.com/<AUTHOR_HANDLE>` (MAN-018..022).
2. `README.md` — look for at least one BMC badge; confirm HTTPS, correct id, `alt`, `width`/`height`, canonical CDN host.
3. Settings tab source (any class extending `PluginSettingTab`) — look for a donate block linking to the same URL; confirm it is built via `createEl` (not `innerHTML`), no runtime script tag, and `rel="noopener noreferrer" target="_blank"` are set.

Run in parallel:
- `Grep pattern="buymeacoffee\.com" glob="**/*.{md,ts,json}"` — presence
- `Grep pattern="buymeacoffee\.com/(?!<FUNDING_HANDLE>\b)[A-Za-z0-9_-]+"` — wrong id (BMC-007)
- `Grep pattern="http://(?:www\.|cdn\.|img\.)?buymeacoffee\.com"` — insecure http (BMC-004)
- `Grep pattern="YOUR_BMC_ID|YOUR_USERNAME|<bmc-id>|example_user"` — leftover placeholder (BMC-008)
- `Grep pattern="buymeacoffee" -C 3` on `**/*.ts` — pull surrounding lines to detect `innerHTML`/script-tag injection and missing rel/target (BMC-010..013)
- `Grep pattern="github\.com/<FUNDING_HANDLE>|\"author\"\s*:\s*\"<FUNDING_HANDLE>\"" glob="**/*.{md,ts,json}"` — detect BMC id leaking into author field (MAN-022)
- `Read manifest.json` — verify `fundingUrl` (BMC-001..002) AND `author`/`authorUrl` (MAN-018..019)
- `Read README.md` — verify badge block, alt/width/height (BMC-003..005, 021, 025)

Then count duplicate BMC url literals across `.ts` files — if more than one f

CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

declared (4 observation(s))

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (6)

check in CI fails the build. Add the `.npmrc`; do not tell the user to rename tags by hand.

const res = await fetch(`http://127.0.0.1:${port}/json/list`);

import { silentWav } from "../../fixture-server.mjs";

Then `GET http://127.0.0.1:<port>/json/list`, take the **main window** — the `page` target whose

> - Payment is required for full access.

> - An account is required for full access.

Gates applied: instruction_override, no_behavioural_pass.