Inspect L0–L3 permissions without running code.
Validate the basic format of plugin.json and hooks.json.