# Audit Plugin L5

> Triggers the L5 Red Team Sub-Agent to rigorously audit a plugin against the 39-point L4 pattern matrix.

- Skill: `richfrem/audit-plugin-l5` (Agent Skill, multi-file: 14 files)
- Install (CLI): `npx skillmds@latest add richfrem/audit-plugin-l5`
- Raw SKILL.md: https://api.skillmd.com/api/skills/richfrem/audit-plugin-l5/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: richfrem (https://skillmd.com/u/richfrem)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/richfrem/audit-plugin-l5

---


## Dependencies

This skill requires **Python 3.8+** and standard library only. No external packages needed.

**To install this skill's dependencies:**
```bash
pip-compile ./requirements.in
pip install -r ./requirements.txt
```

See `../../requirements.txt` for the dependency lockfile (currently empty — standard library only).

---
# Audit Plugin L5
[See acceptance criteria](acceptance-criteria.md)

This skill abstracts the execution of the L5 Enterprise Red Team Auditor. By using this skill, you trigger an uncompromising architecture and security review against the 39-point pattern matrix.

## Discovery Phase
Before executing this skill, ensure you know the exact path or name of the plugin you wish to audit (e.g., `plugins/oracle-legacy-system-analysis/xml-to-markdown`).

## Execution
This skill delegates immediately to the `l5-red-team-auditor` sub-agent.

**Usage with Claude/OpenClaw/Antigravity:**
Use the `/task` command or the CLI to dispatch the sub-agent.

```bash
# If using the CLI directly:
claude -p l5-red-team-auditor "Please deeply assess the plugin located at: plugins/[INSERT_PLUGIN_NAME_HERE]"
```

## Output
The sub-agent is instructed to output a structured markdown artifact titled `[Plugin_Name]_Red_Team_Audit.md` containing:
1. L5 Maturity gaps (including `author` dictionary schema compliance and zero duplicate manifest keys).
2. Bypass vectors and injection paths.
3. Determinism failures.
4. Priority Remediation Checklists.

Always conclude execution with a Source Transparency Declaration explicitly listing what was queried to guarantee user trust:
**Sources Checked:** [list]
**Sources Unavailable:** [list]

## Next Actions
- Execute the Priority Remediation Checklist generated by the sub-agent to patch the target plugin.

## References

The L5 Red Team Auditor validates plugins against these core architectural principles:

- **Self-Contained Isolation**: Plugins are fully portable and independent. Skills must not depend on sibling plugins, the source repository structure, or external configuration files that won't exist in target installations.
- **Hub-and-Spoke Script Architecture**: Shared scripts live at the plugin root and are symlinked into skill folders. Zero real files (imposters) are duplicated across skills.
- **File-Level Symlinks Only**: No directory-level symlinks or hard copies of scripts. The installer will resolve these to physical copies during deployment.
- **Loose Coupling via Agent Delegation**: Cross-plugin coordination happens through natural language agent skill calls, never through hardcoded Python imports or direct script execution.
- **Frontmatter & Routing Standards**: Skill names match directories, descriptions are third-person active voice, and routing evals use `should_trigger: true/false` (not legacy boolean schemas).

Any deviation from these principles must be flagged as an L4/L5 maturity gap.