hooks-b7be7d — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks-b7be7d (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="assets/og-image.png" alt="LogicLeap Labs — Make AI output actually good." width="820"> </p>
<h1 align="center">Claude Code plugins</h1>
<p align="center"> Open tooling for shipping AI output that's actually good.<br> By <a href="https://x.com/logicleaplabs">Josh Matthews</a> · <a href="https://logic-leap.co.uk">LogicLeap Ltd</a> </p>
Most AI coding failures aren't capability failures — they're looking failures. The model can spot the blank sidebar item, the dead empty band, the same row rendered seven times… it just doesn't check. These plugins add the forcing functions that make it check.
# add this marketplace once
claude plugin marketplace add logicleap-labs/claude-plugins
# then install any plugin
claude plugin install visual-qualityRestart Claude Code so hooks load. Disable any time with claude plugin disable <name>.
visual-qualityA hard quality gate for anything with pixels. Built because Claude kept doing compile → screenshot → "looks good" → done and shipping UI with defects a human catches in two seconds.
touch .visual-quality-off).verify-before-doneForces evidence before "done" on any code change. Built because "clean compile" and "updated the handler" kept shipping without a test, build, or smoke run.
touch .verify-before-done-off).scope-guardKeeps an agent in its lane. Built because the most expensive edits are the ones nobody asked for — the "while I'm here" refactor, the reformatted file two directories away, one agent clobbering another's work on a shared tree.
Edit/Write outside the declared scope (.scope-guard file, SCOPE_GUARD_PATHS env, or a SCOPE-GUARD: sentinel). Silent no-op until you opt in, fails open, kill switch (touch .scope-guard-off).no-stubRefuses to let a turn end with half-written code. Built because "scaffold the function → leave a # TODO: implement → done" quietly moves the work back to the human, who finds it at runtime instead of in the reply.
TODO/FIXME/XXX/HACK, NotImplementedError/todo!()/throw new Error("not implemented"), empty ... bodies, "your code here". Only scans added code, ignores docs, dodges JS spreads and type-hint ellipses, fails open, kill switch (touch .no-stub-off). Override a true intentional stub with NO-STUB: INTENTIONAL — <reason>.secret-guardStops a live secret from ever landing in source. Built because a hardcoded key is a leaked key — the moment it hits a tracked file it gets committed, pushed, and mirrored, and you can't un-publish it.
.env (gitignored) and are read at runtime, a placeholder goes in .env.example, and if a key ever touched a file you rotate it.Edit/Write and blocks the write when it carries a live-looking credential into a non-env source file: AWS (AKIA…), GitHub (ghp_…), OpenAI/Anthropic (sk-…/sk-ant-…), Stripe live (sk_live_…/pk_live_…), Google (AIza…), Slack (xox…), -----BEGIN PRIVATE KEY-----, and hardcoded api_key = "…" literals. Allows .env/*.example files, env reads (process.env/os.environ), and placeholders; fails open; kill switch (touch .secret-guard-off). Override one fake-but-shaped fixture with SECRET-GUARD: ALLOW — <reason>.no-slopRefuses to let a turn end with AI-tell "slop" prose. The writing complement to no-stub — built because "write the README → pad it with delve into and a testament to → done" ships copy that loses the reader's trust the moment they spot the tells.
.md/.mdx/.txt/.rst) carries 2+ distinct high-precision AI tells: delve into, it's worth noting that, in today's fast-paced world, navigate the complexities, rich tapestry, a testament to, unlock the full potential, seamlessly integrate, elevate your, furthermore + moreover stacked, em-dash pile-ups. Only scans added prose, ignores code, never fires on bare common words ("leverage"/"robust"), one stray cliché never blocks, fails open, kill switch (touch .no-slop-off). Override deliberate slop (quoting it as an example) with NO-SLOP: INTENTIONAL — <reason>.no-debugRefuses to let a turn end with leftover debug noise. Built because "add a console.log to check the value → forget it's there → done" ships internals to stdout and tells the next reader the code was never cleaned up.
console.log.console.log/console.debug/console.trace/console.dir/debugger, pdb.set_trace()/breakpoint()/import pdb, binding.pry/binding.irb/byebug, var_dump()/print_r()/dd()/dump()/error_log(), dbg!(), and debug-ish print/fmt.Println/System.out.println lines. Never flags console.error/console.warn or real loggers (logger.info, winston, pino, slog, logging.getLogger), skips commented-out lines, only flags ambiguous prints when the line carries debug content (DEBUG/here/===/an emoji), fails open, kill switch (touch .no-debug-off). Override an intentional CLI print with NO-DEBUG: INTENTIONAL — <reason>.no-swallowRefuses to let a turn end with a silently-swallowed error. Built because "wrap it in a try so it stops crashing → leave the catch empty → done" deletes the evidence of a failure that still happened, leaving the next person no log, no stack trace, no signal.
pass/{} is none of those.except: pass / except X: pass / multi-line except bodies that are only pass/.../continue/break; JS/TS empty catch (e) {} / catch {} and trivial .catch(() => {}) / .catch(() => null) / .catch(function(){}); empty catch (...) {} in Java/Kotlin/C#/C++/Swift; and the clearly-empty Go if err != nil {}. Never flags a handler that logs (logger.error/console.error), re-raises (raise/throw), returns, sets error state (setError(e)), or calls a real handler (.catch(handleError)); Swift try? and fallback imports pass. Heuristic, so it fails open on any ambiguity, kill switch (touch .no-swallow-off). Override a deliberate best-effort swallow with NO-SWALLOW: INTENTIONAL — <reason>.The start of a longer-term project: open-sourcing the tools and techniques behind how I actually use AI to build production software. More plugins, comparisons, and write-ups coming — follow along on X (and a YouTube channel soon).
MIT © Josh Matthews / LogicLeap Ltd. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.