$ git clone --depth 1 https://github.com/anthropics/claude-plugins-official
✅ clone ok (9.7 MB shallow, main branch)
$ python3 -c 'json.load(marketplace.json)'  # manifest parses
✅ manifest is valid JSON (170,741 bytes)
$ check: every external source object is SHA-pinned
✅ 236 external entries, 236 SHA-pinned, 0 unpinned
✅ no duplicate plugin names
$ check: local dirs match manifest names
✅ all local plugin dirs have manifest entries (example-plugin is the documented reference impl)
$ check: CI workflows present
✅ 9 CI workflows (scan, validate, frontmatter, licenses, mcp-urls, bump-shas, revert, pr-guards)
$ check: AI review policy artifacts
✅ policy prompt (140 lines) + JSON verdict schema present
$ check: LICENSE + README
✅ Apache-2.0 LICENSE + README present
$ check: in-repo plugin manifests
✅ 25 of 39 in-repo plugins carry plugin.json; 15 manifest-defined by design (12 LSP, receipts, session-report)