Plugin audit findings — 5 issues filed across code quality, DX, and docs

[seankoji]

Ran a full audit of all 4 plugins in this marketplace — code quality, command-prompt design, DX/onboarding, and cross-plugin consistency — using independent deep-dive passes per plugin plus a marketplace-level consistency pass. ~68 findings total, filed as 5 checklist issues (one per plugin + one marketplace-level) rather than one issue per finding, to keep the tracker signal-heavy.

Headline blockers (4)

1. imps — free-text mode runs the persona-review panel before the PR it's supposed to comment on exists (Phase 5 posts reviews in Step 4, opens the PR in Step 6). → #13
2. imps — /imps:prs filters out review comments from the PR's own author to avoid "self-review loops," but the plugin's whole design assumes one GitHub identity does everything — so for a solo maintainer, your own review comments are silently ignored forever. → #13
3. elephant-goldfish — the README's mode table has drifted from the real command: documents a reconcile mode that doesn't exist (the unrecognized token actually routes to a "treat as failure report" path), misdescribes bare-invocation behavior as auto-running the gate (it's actually an interactive menu), and omits the check mode entirely. → #14
4. marketplace-level — schemas/*.schema.json are referenced in CONTRIBUTING.md as enforced manifest contracts, but CI never actually validates against them — a new plugin could ship missing license/author/etc. and pass clean. → #17

Also worth calling out

• claude-tuneup — scan_perms.py strips sudo before computing command patterns, so a proposed allowlist rule for sudo systemctl restart … never matches the real invocation that prompted in the first place. Also: no classification bucket for "this transcript belongs to a different repo" even though the scanner reads ~/.claude/projects/ machine-wide. → #15
• prompt-builder — its own "self-improvement" feature targets ~/.claude/commands/prompt-builder.md for self-edits, which doesn't match how the plugin is actually installed via the marketplace (claude plugin install ...) — the headline feature likely doesn't work as shipped for any real install. → #16
• imps — its namesake imp agent type is never actually shipped with the plugin (no agents/ directory), and the README doesn't disclose that every real install silently falls back to general-purpose with none of the described guarantees. → #13

Already excellent, flagged as do-not-regress

• imps' 5 persona files: genuinely distinct voices, explicit "not your lane" cross-references, uniform machine-parseable verdict line.
• goldfish-judge.sh's set -euo pipefail + trap-based cleanup discipline, and its fail-closed branch-on-real-exit-code pattern rather than trusting model self-report.
• scan_perms.py's clean separation of "script computes, LLM decides" — it never touches settings.json directly.
• prompt-builder's two-layer self-improvement design and CARE framework's explicit degradation note (the pattern its own RTF/APE/TAG cluster is missing).

Issues filed

• #13 — imps (2 blockers, 8 majors, 6 minor/nit)
• #14 — elephant-goldfish (1 blocker, 2 majors, 8 minor/nit)
• #15 — claude-tuneup (8 majors, 7 minor/nit)
• #16 — prompt-builder (2 majors, 7 minor)
• #17 — marketplace-level / cross-plugin consistency (1 blocker, 4 majors, 4 minor, 1 test-coverage gap)