{ "query": "", "kind": "plugin", "page": 1, "pages": 1, "pageSize": 24, "total": 10, "results": [ { "kind": "plugin", "slug": "everything-claude-code", "name": "Everything Claude Code", "vendor": "affaan-m", "description": "A very large community bundle — reported at 64 specialised agents, 261 skills, and 84 commands — spanning TDD, code review, security auditing, deployment, and general automation, plus hooks that wire them into the session.\n\nScale is the whole risk story. A bundle of this size cannot realistically be read before installation, and it brings hundreds of instruction files plus hooks that execute on events into an agent that can already write files and run commands. It declares filesystem read and write, shell execution, and outbound network. Nothing here is inherently malicious, but the review burden is real: installing it is trusting a large surface authored by many hands, and the catalog scores it accordingly.", "website": "https://github.com/affaan-m", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "unknown", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound" ], "packaging": { "manager": "claude-plugin", "packageName": "everything-claude-code" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-unknown", "kind": "trust", "label": "Unknown publisher", "contribution": 20 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, shell:execute", "contribution": 20 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "plugin", "slug": "tons-of-skills", "name": "Tons of Skills Marketplace", "vendor": "jeremylongshore", "description": "An open-source marketplace distributing several hundred plugins and thousands of skills for Claude Code, with a CLI package manager (`ccpi`) for installing them — effectively a package ecosystem layered on top of the plugin mechanism.\n\nA package manager for agent instructions is exactly as significant as a package manager for code, and deserves the same scrutiny that npm eventually earned. Installing through it fetches and places instruction files that the agent will follow, so it declares filesystem read and write, shell execution, and outbound network. The questions to ask are the familiar supply-chain ones: who can publish, what is reviewed, and can a published skill be changed after you installed it.", "website": "https://tonsofskills.com", "repository": "https://github.com/jeremylongshore/claude-code-plugins-plus-skills", "documentationUrl": null, "license": null, "version": null, "trustLevel": "unknown", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound" ], "packaging": { "manager": "claude-plugin", "packageName": "ccpi" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-unknown", "kind": "trust", "label": "Unknown publisher", "contribution": 20 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, shell:execute", "contribution": 20 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "plugin", "slug": "clawhub", "name": "ClawHub", "vendor": "ClawHub", "description": "ClawHub is a public registry for Claude Code plugins — a central index where authors publish and users discover plugins, described by its community as npm for agent skills.\n\nIt is catalogued as ecosystem infrastructure rather than as a plugin you install for a task. Its declared capabilities are outbound network access for the registry API plus the filesystem writes involved in installing what it distributes. Registries concentrate risk by design: they are the single point where a compromise reaches everyone downstream, which is an argument for pinning versions and for preferring plugins whose source you can read over ones you discover by search rank.", "website": "https://clawhub.dev", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "unknown", "capabilities": [ "filesystem:write", "network:outbound" ], "packaging": { "manager": "claude-plugin", "packageName": "clawhub" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 80, "band": "critical", "signals": [ { "id": "trust-unknown", "kind": "trust", "label": "Unknown publisher", "contribution": 20 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "plugin", "slug": "superpowers", "name": "Superpowers", "vendor": "obra", "description": "Superpowers is a community-maintained Claude Code plugin that ships a curated library of skills — short, structured workflows that the Claude Code agent follows for common engineering tasks like brainstorming, test-driven development, systematic debugging, finishing a development branch, and dispatching parallel agents. Once installed, the plugin auto-discovers its skills and exposes them through the standard Claude Code skill-invocation mechanism, so the agent can pick up the right one for the work at hand without the user having to remember command names.\n\nFunctionally, Superpowers reads files in the active project to determine context for each skill, writes edits, commits, and new files when the executing skill asks the agent to, and shells out to git, package managers, test runners, and other developer tools through the Claude Code Bash tool. It does not need separate credentials of its own — it inherits whatever Claude Code is already authorized to do — and it does not make network requests beyond what the underlying agent makes.\n\nSuperpowers is community trust because it is an independent open-source project rather than an official Anthropic plugin. The combination of filesystem write and shell execution lights up several risk signals in the catalog; the recommended posture is to review the bundled skill set before enabling auto-execution and to constrain the plugin's repository scope to the projects where its workflows are actively wanted.", "website": "https://github.com/obra/superpowers", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute" ], "packaging": { "manager": "claude-plugin", "packageName": "superpowers" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 65, "band": "high", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, shell:execute", "contribution": 20 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 } ], "dangerousCombos": [ { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" } ] }, "dangerousCombos": [ { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" } ] }, { "kind": "plugin", "slug": "superpowers-2", "name": "Superpowers 2", "vendor": "obra", "description": "The second-generation Superpowers plugin bundles skills together with hooks that enforce a structured test-driven workflow — parallel task execution, code review, and root-cause debugging — rather than leaving the agent to choose whether to follow the process.\n\nHooks are the meaningful difference from a plain skill library. A hook fires on an event such as a file write or session start, which means part of the plugin runs without the agent deciding to invoke it. That is what makes the workflow stick, and also what makes review important: a hook is code that executes on your machine on a trigger you did not explicitly approve each time. It declares filesystem read and write plus shell execution, inheriting the host agent's authority.", "website": "https://github.com/obra/superpowers", "repository": "https://github.com/obra/superpowers", "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute" ], "packaging": { "manager": "claude-plugin", "packageName": "superpowers-2" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 65, "band": "high", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, shell:execute", "contribution": 20 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 } ], "dangerousCombos": [ { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" } ] }, "dangerousCombos": [ { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" } ] }, { "kind": "plugin", "slug": "szum-tech-claude-plugins", "name": "Szum-Tech Claude Plugins", "vendor": "JanSzewczyk", "description": "A focused marketplace collection of roughly 10 agents and 25 skills covering Next.js, testing, Firebase, product management, and AI tool workflows — curated for a specific stack rather than attempting general coverage.\n\nSmall, opinionated bundles are the easier end of this category to review: 25 skills can actually be read before use, which is not true of the thousand-skill marketplaces. It declares filesystem read and write plus shell execution, inheriting the agent's authority. For teams standardising on the covered stack, a bundle of this size is the sensible middle ground between writing every skill yourself and installing everything.", "website": "https://github.com/JanSzewczyk/claude-plugins", "repository": "https://github.com/JanSzewczyk/claude-plugins", "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute" ], "packaging": { "manager": "claude-plugin", "packageName": "claude-plugins" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 65, "band": "high", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, shell:execute", "contribution": 20 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 } ], "dangerousCombos": [ { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" } ] }, "dangerousCombos": [ { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" } ] }, { "kind": "plugin", "slug": "code-simplifier", "name": "Code Simplifier", "vendor": "community", "description": "Code Simplifier is a community-maintained Claude Code plugin focused on post-implementation code quality. Once the agent finishes a feature or fix, the plugin's review skill walks the changed files looking for opportunities to reuse existing utilities, eliminate dead branches, collapse near-duplicate code paths, and tighten error handling — then either suggests the cleanups for review or applies them in place depending on the user's preference.\n\nFunctionally, the plugin reads files across the active project to identify reusable utilities and dead code, and writes edits back when the user accepts a cleanup. It does not request shell execution, outbound network access, or credentials, and it inherits any project conventions the agent is already aware of rather than enforcing its own opinions.\n\nThe plugin is community trust because it is published by an independent maintainer rather than by Anthropic. The active risk signals come from filesystem read and write — the minimum surface for any plugin that edits source — and do not match any dangerous combination in the catalog. The residual concern is the standard one for code-modification plugins: review the diff before merging, especially when the plugin runs autonomously after a feature implementation.", "website": null, "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write" ], "packaging": { "manager": "claude-plugin", "packageName": "code-simplifier" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "plugin", "slug": "marketing-skills", "name": "Marketing Skills", "vendor": "coreyhaines31", "description": "A domain bundle installing a full set of marketing skills — around 48 of them — covering paid acquisition, SEO, lifecycle email, analytics, and positioning, so a single install equips an agent for marketing work rather than engineering.\n\nIts capability profile is unusually light for a plugin: most of these skills are process and copy rather than automation, so the bundle declares filesystem read and write for the documents it produces, with outbound network for the research-oriented skills. It is a useful catalog data point that not every plugin is a code-execution risk — a bundle's score should follow what its skills actually touch, and this one touches drafts.", "website": "https://github.com/coreyhaines31", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "claude-plugin", "packageName": "marketing-skills" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "plugin", "slug": "pulse-recency-research", "name": "Pulse", "vendor": "community", "description": "A deliberately single-purpose plugin that installs one skill: recency research, which checks whether what an agent believes about a fast-moving topic is actually current rather than a memory of how things were at training time.\n\nIt declares outbound network access only. The reason it is worth catalogueing next to the thousand-skill bundles is the contrast: a one-skill plugin can be read in a minute, does one thing, and adds one capability. For a category where the dominant failure is installing far more instruction surface than anyone reviews, single-purpose plugins are the pattern that scales safely.", "website": "https://www.aitmpl.com/plugins/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "network:outbound" ], "packaging": { "manager": "claude-plugin", "packageName": "pulse" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 40, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "plugin", "slug": "frontend-design", "name": "Frontend Design", "vendor": "anthropics", "description": "Frontend Design is an official Anthropic plugin for Claude Code that bundles design-system patterns, component recipes, and a frontend-design skill that the Claude Code agent follows when asked to build web components, pages, or applications. The plugin's intent is to push the agent away from generic AI-generated UI aesthetics and toward distinctive, production-grade interfaces by codifying repeatable visual and structural decisions.\n\nWhen invoked, the skill reads files in the active project to understand the existing component conventions, writes new components and styles into the project, and follows a structured set of design decisions captured in its reference material. It does not request shell execution, network access, or credentials of its own.\n\nFrontend Design is one of the few entries in the catalog with the official trust level — published by Anthropic, the maintainer of Claude Code itself, which means the most favorable trust adjustment available in the scoring model. The remaining risk signals come from filesystem read and write, which are the minimum required for any plugin that produces source files, and do not match any dangerous combination. It is one of the lowest-risk plugins in the catalog.", "website": "https://github.com/anthropics/claude-code", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "filesystem:read", "filesystem:write" ], "packaging": { "manager": "claude-plugin", "packageName": "frontend-design" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 20, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] } ] }