Slash Command

Verify Plugin

Verify plugin behavioral contract history via GitHub Attestations (SLSA)

Type: Slash Command
Repository: athola/claude-night-market
GitHub stars: 339
License: MIT
Repo last updated: Sep 24, 2026
Source file: plugins/leyline/commands/verify-plugin.md

What Verify Plugin is

Verify Plugin is a slash command published in the athola/claude-night-market repository on GitHub, which has about 339 stars. The repository describes itself as: “23 Claude Code plugins: TDD enforcement hooks, git/PR workflows, spec-driven development, code review, project lifecycle, fix-from-error, maintenance automation, context optimization, research, and multi-LLM delegation. 186 skills, 128 commands, 54 agents.”

A slash command is a reusable prompt saved as a markdown file and run by typing its name after a slash. In Claude Code, custom commands have been merged into skills: a file in .claude/commands/ and a skill folder in .claude/skills/ both create the same kind of command, and existing command files keep working.

Verify Plugin gives you a repeatable way to run the same instructions without retyping them, optionally with arguments.

How to install Verify Plugin

Claude Code

Download verify-plugin.md from the repository.
Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md.
Run it by typing / followed by its name.

Claude Cowork

Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it.
In Customize → Skills, click +, then upload the ZIP.
Run it from any task with / and the skill name.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/leyline/commands/verify-plugin.md, shared under the repository's MIT license. Read the full file on GitHub.

Query GitHub Actions workflow runs for a plugin's behavioral contract assertion history and produce a trust assessment. Uses GitHub's free SLSA attestation infrastructure.

When to Use

Before installing a plugin from an unfamiliar source
In CI pipelines to gate deployments on trust scores
To audit a plugin's verification track record over time
When evaluating whether to upgrade trust level requirements

When NOT to Use

The plugin is local-only with no GitHub Actions history
You are offline and cannot reach the GitHub API
The trust-attestation workflow has not been set up yet

Workflow

The command runs the verification script which:

Parse arguments: plugin name, optional level and score threshold
Query GitHub API: fetch recent workflow run results for the repository
Compute pass rates: calculate L1/L2/L3 pass rates from workflow conclusions
Produce assessment: return a recommendation of "trusted", "caution", or "untrusted" based on whether the target level meets the minimum score threshold

Output

The script prints a human-readable summary:

Plugin: sanctum
Recommendation: trusted
Meets threshold: True

Level scores:
  L1: 10/10 (100.0% pass rate)
  L2: 0/0 (0.0% pass rate)
  L3: 0/0 (0.0% pass rate)

Recent assertions: 10 records

Use --json for machine-readable output in CI.

Exit Codes

Examples

Verify with defaults (L1, 80% threshold):

python3 plugins/leyline/scripts/verify_plugin.py sanctum

Strict L3 verification:

python3 plugins/leyline/scripts/verify_plugin.py sanctum --level L3 --min-score 0.9

JSON output for CI:

python3 plugins/leyline/scripts/verify_plugin.py sanctum --json

Prerequisites

The gh CLI must be installed and authenticated
Use --repo owner/repo to specify a different repository (default: athola/claude-night-market)

Notes

All GitHub API calls are read-only; no write permissions needed
Assertion history comes from the 10 most recent completed workflow runs
The caution zone is between 70% and 100% of the threshold (e.g., for 0.8 threshold, 0.56-0.79 is caution)

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Verify Plugin?

Verify Plugin is a slash command for Claude Code and Claude Cowork from the athola/claude-night-market repository on GitHub. Verify plugin behavioral contract history via GitHub Attestations (SLSA)

How do I install Verify Plugin in Claude Code?

Download verify-plugin.md from the repository. Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md. Run it by typing / followed by its name.

Can I use Verify Plugin in Claude Cowork?

Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it. In Customize → Skills, click +, then upload the ZIP. Run it from any task with / and the skill name.

Is Verify Plugin safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under MIT. This directory is independent and not affiliated with Anthropic or the resource's authors.