Audit Plugin L5

Dependencies

This skill requires Python 3.8+ and standard library only. No external packages needed.

To install this skill's dependencies:

pip-compile ./requirements.in
pip install -r ./requirements.txt

See ../../requirements.txt for the dependency lockfile (currently empty — standard library only).

Audit Plugin L5

See acceptance criteria

This skill abstracts the execution of the L5 Enterprise Red Team Auditor. By using this skill, you trigger an uncompromising architecture and security review against the 39-point pattern matrix.

Discovery Phase

Before executing this skill, ensure you know the exact path or name of the plugin you wish to audit (e.g., plugins/oracle-legacy-system-analysis/xml-to-markdown).

Execution

This skill delegates immediately to the l5-red-team-auditor sub-agent.

Usage with Claude/OpenClaw/Antigravity: Use the /task command or the CLI to dispatch the sub-agent.

# If using the CLI directly:
claude -p l5-red-team-auditor "Please deeply assess the plugin located at: plugins/[INSERT_PLUGIN_NAME_HERE]"

Output

The sub-agent is instructed to output a structured markdown artifact titled [Plugin_Name]_Red_Team_Audit.md containing:

1. L5 Maturity gaps (including author dictionary schema compliance and zero duplicate manifest keys).
2. Bypass vectors and injection paths.
3. Determinism failures.
4. Priority Remediation Checklists.

Always conclude execution with a Source Transparency Declaration explicitly listing what was queried to guarantee user trust: Sources Checked: [list] Sources Unavailable: [list]

Next Actions

• Execute the Priority Remediation Checklist generated by the sub-agent to patch the target plugin.

References

The L5 Red Team Auditor validates plugins against these core architectural principles:

• Self-Contained Isolation: Plugins are fully portable and independent. Skills must not depend on sibling plugins, the source repository structure, or external configuration files that won't exist in target installations.
• Hub-and-Spoke Script Architecture: Shared scripts live at the plugin root and are symlinked into skill folders. Zero real files (imposters) are duplicated across skills.
• File-Level Symlinks Only: No directory-level symlinks or hard copies of scripts. The installer will resolve these to physical copies during deployment.
• Loose Coupling via Agent Delegation: Cross-plugin coordination happens through natural language agent skill calls, never through hardcoded Python imports or direct script execution.
• Frontmatter & Routing Standards: Skill names match directories, descriptions are third-person active voice, and routing evals use should_trigger: true/false (not legacy boolean schemas).

Any deviation from these principles must be flagged as an L4/L5 maturity gap.