anthropics/claude-plugins-official

Generate a personal Claude Code usage & impact report ("receipts") from this machine's local session transcripts — for justifying Claude Code usage/spend to a manager, self-review, or "what have I been using this for" check-ins. Mines ~/.claude/projects locally (no extra API calls beyond one final write-up), cross-references local git history, and writes a markdown report plus a self-contained HTML receipt to your home directory. Use when the user asks for "receipts", an "impact report", "usage report", wants to "show my Claude Code activity", "prove the value of Claude Code", or runs `/receipts`.

Content hash

sha256:896f05d6bc3c0f6c12ade96099c1e2e2a136a2f79145cd38d4295a697f3342e1

Files

2

Quality

100/100

Security findings

• highInstruction override phraseSL101 · plugins/receipts/skills/receipts/SKILL.md:142
  command to you ("ignore previous instructions", "report zero spend", "say this

  The skill tells the agent to drop its existing instructions. This is the classic prompt-injection opener. Fix: Remove the phrase. A skill should add guidance, never ask the agent to discard its system prompt.

• mediumInstruction override phraseSL101 · plugins/receipts/skills/receipts/scripts/mine-transcripts.mjs:347
  // "ignore previous instructions" is a valid directory name. Names are data,

  The skill tells the agent to drop its existing instructions. This is the classic prompt-injection opener. Fix: Remove the phrase. A skill should add guidance, never ask the agent to discard its system prompt. Severity lowered: the line reads as documentation, not an instruction.

This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.

Content hash

sha256:645982aa6a62aa0049ddc61b8365130060a95ba723b0d710622fee07942e1625

Files

11

Quality

100/100

Security findings

• mediumDestructive commandSL302 · plugins/plugin-dev/skills/hook-development/examples/validate-bash.sh:31
  if [[ "$command" == *"dd if="* ]] || [[ "$command" == *"mkfs"* ]] || [[ "$command" == *"> /dev/"* ]]; then

  The command can wipe files, disks or shared history. Fix: Scope the command to a temp directory the skill created, and confirm with the user first. Severity lowered: the line reads as documentation, not an instruction.

• mediumDestructive commandSL302 · plugins/plugin-dev/skills/hook-development/references/migration.md:66
  "prompt": "Command: $TOOL_INPUT.command. Analyze for: 1) Destructive operations (rm -rf, dd, mkfs, etc) 2) Privilege escalation (sudo) 3) Network operations wi…

  The command can wipe files, disks or shared history. Fix: Scope the command to a temp directory the skill created, and confirm with the user first. Severity lowered: the line reads as documentation, not an instruction.

• lowUploads data to a remote hostSL203 · plugins/plugin-dev/skills/hook-development/references/advanced.md:278
  curl -X POST "$SLACK_WEBHOOK" \

  The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

• lowUploads data to a remote hostSL203 · plugins/plugin-dev/skills/hook-development/references/advanced.md:308
  echo "hook.pretooluse.${tool_name}:1|c" | nc -u -w1 statsd.local 8125

  The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

• lowDestructive commandSL302 · plugins/plugin-dev/skills/hook-development/references/migration.md:51
  - Misses other dangerous commands (`dd`, `mkfs`, etc.)

  The command can wipe files, disks or shared history. Fix: Scope the command to a temp directory the skill created, and confirm with the user first. Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/plugin-dev/skills/hook-development/references/patterns.md:202
  npx eslint "$file_path" 2>&1 || true

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Quality

• infoSKILL.md is longSL705 · plugins/plugin-dev/skills/hook-development/SKILL.md:1
  713 lines

  Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

This skill should be used when the user asks to "create a hookify rule", "write a hook rule", "configure hookify", "add a hookify rule", or needs guidance on hookify rule syntax and patterns.

Content hash

sha256:9237274ec2d24f1e8e96c401040be40cacf70524091a35fb71122679ff1fe386

Files

1

Quality

100/100

Security findings

• mediumDynamic code evaluationSL303 · plugins/hookify/skills/writing-rules/SKILL.md:249
  (eval|exec)\( Matches: eval( or exec(

  The skill builds code at runtime, which hides what actually runs. Fix: Ship the real code as a file in the skill so it can be reviewed and hashed.

• lowDestructive commandSL302 · plugins/hookify/skills/writing-rules/SKILL.md:143
  - Dangerous commands: `rm\s+-rf`, `dd\s+if=`, `mkfs`

  The command can wipe files, disks or shared history. Fix: Scope the command to a temp directory the skill created, and confirm with the user first. Severity lowered: the line reads as documentation, not an instruction.

Set up the Discord channel — save the bot token and review access policy. Use when the user pastes a Discord bot token, asks to configure Discord, asks "how do I set this up" or "who can reach me," or wants to check channel status.

Content hash

sha256:d81671f84efc9c343417521f953125660acd5c1ed1037cd9ed0ee450a28ea3e9

Files

1

Quality

100/100

Security findings

• mediumRole reassignmentSL103 · external_plugins/discord/skills/configure/SKILL.md:62
  directly: *"Enable Developer Mode in Discord (User Settings → Advanced),

  The skill tries to reassign the agent's identity or unlock a 'mode'. Fix: Describe the task instead of redefining who the agent is.

An example user-invoked skill that demonstrates frontmatter options and the skills/<name>/SKILL.md layout

Content hash

sha256:50ecde9031c0f4994dc3be21330893bd5dd892801c7b5c3cadea356154c43d32

Files

1

Quality

100/100

Security findings

• mediumUnrestricted shell accessSL601 · plugins/example-plugin/skills/example-command/SKILL.md:1
  Bash

  allowed-tools grants the skill any shell command without confirmation. Fix: Scope it, for example 'Bash(git status:*)' or 'Bash(npm test)'.

Work on one hard mathematics problem in this session yourself, with no sub-agents: reason in stages, record each settled step in a notes file so that nothing written is lost if a response is cut off, and end with a self-contained proof.md. Usage: /math-proof:solo <the problem, stated in full, or the path of a file holding it>.

Content hash

sha256:d00f257af53375caeb7d5eba7836bd3c5f3739a9a2b49209398a0e54f4127620

Files

1

Quality

100/100

Security findings

• mediumRole reassignmentSL103 · plugins/math-proof/skills/solo/SKILL.md:53
  reduction, a dead end and why it is dead, the precise statement you are now attempting — write it down before

  The skill tries to reassign the agent's identity or unlock a 'mode'. Fix: Describe the task instead of redefining who the agent is.

This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.

Content hash

sha256:4a7879acda19f6919f75cfdec560dc4650dbdc71330bfa7312819b16859b982a

Files

11

Quality

100/100

Security findings

• mediumInstructions hidden in an HTML commentSL113 · plugins/plugin-dev/skills/command-development/references/marketplace-considerations.md:731
  PRE-RELEASE CHECKLIST: Functionality: - [ ] Works on macOS - [ ] Works on Linux - [ ] Works on Windows (WSL) - [ ] All arguments tested - [ ] Error cases handl…

  Markdown renderers hide HTML comments from people, but agents still read them. Fix: Move the text into visible prose or delete it.

Quality

• infoSKILL.md is longSL705 · plugins/plugin-dev/skills/command-development/SKILL.md:1
  885 lines

  Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

This skill should be used when the user wants to "package an MCP server", "bundle an MCP", "make an MCPB", "ship a local MCP server", "distribute a local MCP", discusses ".mcpb files", mentions bundling a Node or Python runtime with their MCP server, or needs an MCP server that interacts with the local filesystem, desktop apps, or OS and must be installable without the user having Node/Python set up.

Content hash

sha256:947539c19b540c19fde05cc74a47e155ea4a5509f61ec73b7f2445a194eab2c3

Files

3

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:137
  npx esbuild src/index.ts --bundle --platform=node --outfile=server/index.js

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:139
  npx @anthropic-ai/mcpb pack

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:148
  npx @anthropic-ai/mcpb pack

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:177
  npx @anthropic-ai/mcpb init

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:180
  npx @modelcontextprotocol/inspector node server/index.js

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:183
  npx @anthropic-ai/mcpb validate

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:184
  npx @anthropic-ai/mcpb pack

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcpb/SKILL.md:187
  npx @anthropic-ai/mcpb sign dist/local-files.mcpb

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

End-to-end onboarding for a freshly-plugged-in M5Stack ESP32 device (Cardputer, Cardputer-Adv, Core, CoreS3, Stick) — detect on USB, flash UIFlow 2.0 firmware, and install the Claude Buddy MicroPython app bundle. Use whenever the user plugs in or wants to flash/provision/reset an M5Stack or ESP32 board, or says "m5-onboard go".

Content hash

sha256:aa77a9cd0f4ebf8fc5b183d19616d74e7590e3db968d75076f80a8d9e663db6d

Files

1

Quality

100/100

Security findings

• lowRuns with elevated privilegesSL305 · plugins/cwc-makers/skills/m5-onboard/SKILL.md:139
  - **Linux** — use the distro package manager. Debian/Ubuntu: `sudo apt-get update && sudo apt-get install -y python3 python3-pip`. Fedora: `sudo dnf install -y…

  The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

• lowRuns with elevated privilegesSL305 · plugins/cwc-makers/skills/m5-onboard/SKILL.md:169
  sudo usermod -aG dialout $USER

  The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

• lowRuns with elevated privilegesSL305 · plugins/cwc-makers/skills/m5-onboard/SKILL.md:172
  `sudo python3 scripts/onboard.py ...` works as a one-off but adding the group membership is strictly better because pyserial's port-open in user mode succeeds …

  The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

• infoRuns with elevated privilegesSL305 · plugins/cwc-makers/skills/m5-onboard/SKILL.md:167
  - **Linux permissions — read this before blaming hardware.** On most distros, accessing `/dev/ttyUSB*` / `/dev/ttyACM*` without sudo requires group membership …

  The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command. Severity lowered: the line reads as documentation, not an instruction.

Solve competition math problems (IMO, Putnam, USAMO, AIME) with adversarial verification that catches the errors self-verification misses. Activates when asked to 'solve this IMO problem', 'prove this olympiad inequality', 'verify this competition proof', 'find a counterexample', 'is this proof correct', or for any problem with 'IMO', 'Putnam', 'USAMO', 'olympiad', or 'competition math' in it. Uses pure reasoning (no tools) — then a fresh-context adversarial verifier attacks the proof using specific failure patterns, not generic 'check logic'. Outputs calibrated confidence — will say 'no confident solution' rather than bluff. If LaTeX is available, produces a clean PDF after verification passes.

Content hash

sha256:2463a735f9fbde67e53f7f0527a3047f7575ef83f5425d63090f74adcc05f631

Files

11

Quality

100/100

Security findings

• lowRole reassignmentSL103 · plugins/math-olympiad/skills/math-olympiad/references/attempt_agent.md:19
  Switch roles. You are now a strict IMO grader. Check every step. Classify each

  The skill tries to reassign the agent's identity or unlock a 'mode'. Fix: Describe the task instead of redefining who the agent is. Severity lowered: the line reads as documentation, not an instruction.

This skill should be used when the user wants to build an "MCP app", add "interactive UI" or "widgets" to an MCP server, "render components in chat", build "MCP UI resources", make a tool that shows a "form", "picker", "dashboard" or "confirmation dialog" inline in the conversation, or mentions "apps SDK" in the context of MCP. Use AFTER the build-mcp-server skill has settled the deployment model, or when the user already knows they want UI widgets.

Content hash

sha256:4c0f881afad849e77800ff1e8da08b7e91f91d34d69104575b0fc0b2740aa7f1

Files

7

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-app/SKILL.md:356
  (cat test.jsonl; sleep 10) | npx mcp-remote http://localhost:3000/mcp --allow-http

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Generate and publish a project status artifact — an opinionated, tabbed status page for a project too big for one update (overview & success criteria, the workstream sequence, next steps, plus background, plan, risks & open questions, and decisions/FAQ when they earn a tab) — published with the built-in Artifact tool to a default-private claude.ai page the user can share with teammates. Use when a piece of work spans several workstreams and you want a shareable overview kept current. Each artifact is backed by a small per-project config in the plugin data dir, so refreshing it re-gathers live state, redeploys the same URL, and reports only the delta. For software projects whose workstreams are PRs, also read swe.md (the X.Y PR-numbering convention; pulling PR state with gh/git; a per-PR detail block). Needs the built-in Artifact tool (claude.ai login). Not for single-PR changes or public docs.

Content hash

sha256:96919a8d3e525f32992a4fd3793998c28078035970255cd7389d9848f2326c59

Files

3

Quality

100/100

Security findings

• lowHides actions from the userSL102 · plugins/project-artifact/skills/project-artifact/SKILL.md:43
  see **"Reading an existing artifact page"** below. Don't ask the user to paste content or hand you a local file

  The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.

Manage Discord channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or change policy for the Discord channel.

Content hash

sha256:e603e6416f868e8a9344ab37fea7c5770b2a8c915c7233e520965b3e1dfeed36

Files

1

Quality

100/100

Security findings

None of the 30 rules matched.

Manage iMessage channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or change policy for the iMessage channel.

Content hash

sha256:3e3933c529345c543e8bb1ccd02243e04beaf5eab2b95567ac6a0eb3aea7987e

Files

1

Quality

100/100

Security findings

None of the 30 rules matched.

Check iMessage channel setup and review access policy. Use when the user asks to configure iMessage, asks "how do I set this up" or "who can reach me," or wants to know why texts aren't reaching the assistant.

Content hash

sha256:2013515a50c9200e9f920ff4ad0a83c7feb076631e18cd7e32c75917e211ab90

Files

1

Quality

100/100

Security findings

None of the 30 rules matched.

Manage Telegram channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or change policy for the Telegram channel.

Content hash

sha256:adcbd3b975cace68355d78ca4e5f703475dc6c42bbd09ea1be8eaefde0763fb3

Files

1

Quality

100/100

Security findings

None of the 30 rules matched.

Set up the Telegram channel — save the bot token and review access policy. Use when the user pastes a Telegram bot token, asks to configure Telegram, asks "how do I set this up" or "who can reach me," or wants to check channel status.

Content hash

sha256:17d0bc4a080dbecc4cd4c113fac8fe4f3f736115c31df91028747b5847925418

Files

1

Quality

100/100

Security findings

None of the 30 rules matched.

Analyze a codebase and recommend Claude Code automations (hooks, subagents, skills, plugins, MCP servers). Use when user asks for automation recommendations, wants to optimize their Claude Code setup, mentions improving Claude Code workflows, asks how to first set up Claude Code for a project, or wants to know what Claude Code features they should use.

Content hash

sha256:e1ddd00c402d6d9824404e001ec8a46c045cd4cd0e4f35b655fd203d3013379a

Files

6

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/claude-code-setup/skills/claude-automation-recommender/references/mcp-servers.md:85
  **Value**: Claude can introspect the live deployment (tables, function specs, env vars, logs) and execute queries/mutations against it via tools like `tables`,…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/claude-code-setup/skills/claude-automation-recommender/references/skills-reference.md:188
  npx prisma validate 2>&1 || echo "Validation failed"

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates quality against templates, outputs quality report, then makes targeted updates. Also use when the user mentions "CLAUDE.md maintenance" or "project memory optimization".

Content hash

sha256:b223cc24d57617d7f26b4f475eff879c2400ba9c560e0234e1fb6f886dbbec5a

Files

4

Quality

100/100

Security findings

None of the 30 rules matched.

Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the user asks to scan, audit or check code with Claude Security, to scan their changes with Claude Security, or to fix or patch Claude Security findings.

Content hash

sha256:187b2862d7a64e7efe2e7da701212100e7c0dce8225722f35a46406ef9aa0321

Files

7

Quality

95/100

Security findings

None of the 30 rules matched.

Quality

• lowBroken local linkSL706 · plugins/claude-security/skills/claude-security/SKILL.md:42
  ${CLAUDE_SKILL_DIR}/jobs/scan-codebase.md

  Linked file '${CLAUDE_SKILL_DIR}/jobs/scan-codebase.md' is not in the skill. Fix: Add the file or fix the link.

• lowBroken local linkSL706 · plugins/claude-security/skills/claude-security/SKILL.md:43
  ${CLAUDE_SKILL_DIR}/jobs/scan-changes.md

  Linked file '${CLAUDE_SKILL_DIR}/jobs/scan-changes.md' is not in the skill. Fix: Add the file or fix the link.

• lowBroken local linkSL706 · plugins/claude-security/skills/claude-security/SKILL.md:44
  ${CLAUDE_SKILL_DIR}/jobs/suggest-patches.md

  Linked file '${CLAUDE_SKILL_DIR}/jobs/suggest-patches.md' is not in the skill. Fix: Add the file or fix the link.

• lowBroken local linkSL706 · plugins/claude-security/skills/claude-security/SKILL.md:51
  ${CLAUDE_PLUGIN_ROOT}/scripts

  Linked file '${CLAUDE_PLUGIN_ROOT}/scripts' is not in the skill. Fix: Add the file or fix the link.

• lowBroken local linkSL706 · plugins/claude-security/skills/claude-security/SKILL.md:52
  ${CLAUDE_SKILL_DIR}/specs/report-spec.md

  Linked file '${CLAUDE_SKILL_DIR}/specs/report-spec.md' is not in the skill. Fix: Add the file or fix the link.

• lowBroken local linkSL706 · plugins/claude-security/skills/claude-security/SKILL.md:53
  ${CLAUDE_SKILL_DIR}/specs/patch-spec.md

  Linked file '${CLAUDE_SKILL_DIR}/specs/patch-spec.md' is not in the skill. Fix: Add the file or fix the link.

Iterate on the Cardputer-Adv MicroPython app bundle (Claude Buddy, Snake, Hello) after the device is already provisioned via m5-onboard. Use when the user wants to add a new app, push a single changed .py without re-flashing, watch device serial logs, or run a one-shot REPL command. Trigger on "add an app", "push to the cardputer", "tail the device", "run on the device", or follow-up work after /maker-setup.

Content hash

sha256:ee08347f6cfe39503c44218c7fd5137097fc0dc81baa1b94b9f1ffb1a26b7a17

Files

1

Quality

100/100

Security findings

None of the 30 rules matched.

This skill should be used when the user asks to "demonstrate skills", "show skill format", "create a skill template", or discusses skill development patterns. Provides a reference template for creating Claude Code plugin skills.

Content hash

sha256:91cbbfd06b2f737115dd59c09500a1082b6228b84939411a7c0d338a5d83d477

Files

1

Quality

100/100

Security findings

None of the 30 rules matched.

Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.

Content hash

sha256:89a6e59de80320a32e8b4c597a329ef3c503f624a2e68874bb0475dfb66dbf4b

Files

2

Quality

100/100

Security findings

None of the 30 rules matched.

Work on one hard mathematics problem in rounds: each round a judge writes a few self-contained questions, independent workers answer them, and the judge keeps a ledger of what is proved, refuted and open, until the judge concludes or the rounds run out, and then a proof.md says plainly what is and is not proved. A run takes hours and dozens of worker runs. Usage: /math-proof:siege [NAME=value settings] <the problem, stated in full, or the path of a file holding it>.

Content hash

sha256:acf39816560b6f7fed88dd03774bf90c3eb9a69fba419ad5c8e63eab32ff80f6

Files

2

Quality

100/100

Security findings

None of the 30 rules matched.

Quality

• infoSKILL.md is longSL705 · plugins/math-proof/skills/siege/SKILL.md:1
  733 lines

  Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

This skill should be used when the user asks to "build an MCP server", "create an MCP", "make an MCP integration", "wrap an API for Claude", "expose tools to Claude", "make an MCP app", or discusses building something with the Model Context Protocol. It is the entry point for MCP server development — it interrogates the user about their use case, determines the right deployment model (remote HTTP, MCPB, local stdio), picks a tool-design pattern, and hands off to specialized skills.

Content hash

sha256:4c8b5276a21b774ebb8fd6b8c117013008acd57a7a4da069989e4c1a61950669

Files

9

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/deploy-cloudflare-workers.md:94
  npx wrangler dev # → http://localhost:8787/mcp

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/deploy-cloudflare-workers.md:95
  npx wrangler deploy # → https://my-mcp-server.<account>.workers.dev/mcp

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/deploy-cloudflare-workers.md:100
  Secrets (upstream API keys): `npx wrangler secret put UPSTREAM_API_KEY`, then read `env.UPSTREAM_API_KEY` inside `init()`.

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:84
  pip install fastmcp

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:164
  npx @modelcontextprotocol/inspector

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:171
  npx @modelcontextprotocol/inspector --cli http://localhost:3000/mcp \

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:174
  npx @modelcontextprotocol/inspector --cli http://localhost:3000/mcp \

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Creates interactive HTML playgrounds — self-contained single-file explorers that let users configure something visually through controls, see a live preview, and copy out a prompt. Use when the user asks to make a playground, explorer, or interactive tool for a topic.

Content hash

sha256:681ea85221f131b8843492b363b3abd5f25d207241dd5dd2c4aced78e125267c

Files

7

Quality

100/100

Security findings

None of the 30 rules matched.

This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.

Content hash

sha256:424c48edd41e7e42ea995706bab33d27b8c4e0ac4b0cf88741c24ef3f1357648

Files

7

Quality

100/100

Security findings

None of the 30 rules matched.

This skill should be used when the user asks to "add MCP server", "integrate MCP", "configure MCP in plugin", "use .mcp.json", "set up Model Context Protocol", "connect external service", mentions "${CLAUDE_PLUGIN_ROOT} with MCP", or discusses MCP server types (SSE, stdio, HTTP, WebSocket). Provides comprehensive guidance for integrating Model Context Protocol servers into Claude Code plugins for external tool and service integration.

Content hash

sha256:e4cda25e973010e205157a20c973eb5325aa413f874b6a8520ee864db884a39a

Files

7

Quality

100/100

Security findings

None of the 30 rules matched.

Quality

• infoSKILL.md is longSL705 · plugins/plugin-dev/skills/mcp-integration/SKILL.md:1
  555 lines

  Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

This skill should be used when the user asks about "plugin settings", "store plugin configuration", "user-configurable plugin", ".local.md files", "plugin state files", "read YAML frontmatter", "per-project plugin settings", or wants to make plugin behavior configurable. Documents the .claude/plugin-name.local.md pattern for storing plugin-specific configuration with YAML frontmatter and markdown content.

Content hash

sha256:0d6deeec43a1b8e0e857fa92e448637f9b50959af1afcb03c858bae8803318ce

Files

8

Quality

100/100

Security findings

None of the 30 rules matched.

Quality

• infoSKILL.md is longSL705 · plugins/plugin-dev/skills/plugin-settings/SKILL.md:1
  545 lines

  Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

This skill should be used when the user asks to "create a plugin", "scaffold a plugin", "understand plugin structure", "organize plugin components", "set up plugin.json", "use ${CLAUDE_PLUGIN_ROOT}", "add commands/agents/skills/hooks", "configure auto-discovery", or needs guidance on plugin directory layout, manifest configuration, component organization, file naming conventions, or Claude Code plugin architecture best practices.

Content hash

sha256:4d9ec1a29112b903636dee4f5cded020266e002aa028e81ff4f33e62cc7fc014

Files

7

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/plugin-dev/skills/plugin-structure/examples/standard-plugin.md:485
  if ! npx eslint "$file" --quiet; then

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

This skill should be used when the user wants to "create a skill", "add a skill to plugin", "write a new skill", "improve skill description", "organize skill content", or needs guidance on skill structure, progressive disclosure, or skill development best practices for Claude Code plugins.

Content hash

sha256:09eeac54f4b8a1b8fa9bd1fabd4b4e52c20a29bfc1d25e0c5044ac644d5c1964

Files

2

Quality

100/100

Security findings

None of the 30 rules matched.

Quality

• infoSKILL.md is longSL705 · plugins/plugin-dev/skills/skill-development/SKILL.md:1
  638 lines

  Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

Generate an explorable HTML report of Claude Code session usage (tokens, cache, subagents, skills, expensive prompts) from ~/.claude/projects transcripts.

Content hash

sha256:1444f03c4a5954953b623873c526d6030cfbec9b8f36b40234c1ea9cc3c76c00

Files

3

Quality

100/100

Security findings

None of the 30 rules matched.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

Content hash

sha256:bd1f568c543eaa2ee91fed6eb1d7b4bee6706ccaf8a4f55512ef144778e7fcd0

Files

18

Quality

100/100

Security findings

None of the 30 rules matched.