Obsidian Plugin Review Checker
Scans your plugin's manifest.json, versions.json, and JavaScript/TypeScript
source for the patterns behind common Obsidian community-plugin review delays: missing required
manifest fields, leftover sample-plugin template placeholder values, a manifest
version with no matching versions.json entry, and
innerHTML/outerHTML/insertAdjacentHTML usage. Everything runs
in this tab; nothing is uploaded. A command-line version for CI is in the same
repository
(node check.mjs .).
Pick your plugin's project folder (includes
manifest.json, versions.json,
and your .js/.ts source). Not at your project right now?
instead.No folder selected yet.
Common questions
Why does a missing versions.json entry matter for an Obsidian plugin release?
Obsidian's release mechanism reads versions.json to decide which installed app versions can see a given plugin release. manifest.json only carries the current version; versions.json has to carry its own matching entry, in a separate file, with nothing forcing the two to move together. This tool reads both and tells you if the current version is missing.
What are the sample-plugin placeholder values this tool flags?
The official obsidian-sample-plugin GitHub template ships manifest.json with id "sample-plugin", name "Sample Plugin", and author "Your Name". A submission that still carries any of these has not customized the template it was generated from -- a leftover reviewers name explicitly.
Why does innerHTML/outerHTML/insertAdjacentHTML matter in an Obsidian plugin?
Obsidian's own developer guidelines name these APIs as a cross-site-scripting risk and recommend the DOM API or Obsidian's own createEl/createSpan/createDiv helpers instead. This tool scans for the assignment or call regardless of whether the specific value used happens to be attacker-controlled today -- the fix is standard, and reviewers ask for it as a matter of course.
Is my plugin's source code uploaded anywhere?
No. The browser tool reads the files or folder you select using the File API and never sends them anywhere -- everything happens in memory in your tab. The CLI never makes a network call either.
Does a clean report mean my plugin will be approved for the community plugin list?
No. This is evidence from pattern-matching your manifest.json, versions.json, and source against known field names and API calls -- it is not the review process, and it is a line-level heuristic, not data-flow or runtime analysis. It can miss an innerHTML assignment built from a value that is actually safe, a registerDomEvent call the reviewer would still ask about for an unrelated reason, or a guideline this tool does not check at all. Always re-check against Obsidian's current developer guidelines before submitting.
More on the most common of these: Fixing a missing versions.json entry.
Already using ESLint? See how this checker compares to eslint-plugin-obsidianmd, the official Obsidian ESLint plugin.