Plugin validators are good at answering one narrow question: does this manifest match the schema the harness expects?
That is necessary, but it is not the same as proving that the package a user installs still contains a working plugin.
The gap gets wider when one repository targets both Codex and Claude Code. The two harnesses share several conventions, but they do not have identical requirements. Codex requires .codex-plugin/plugin.json; Claude Code can infer a plugin from default component locations. Both support Agent Skills. Their marketplace and component-loading rules differ at the edges.
Here are five package failures that can survive a basic manifest check.
1. The published package omits a runtime component
