skillhash

Is plugin-structure safe?

Grade A, 100/100. No meaningful risk found.

This skill should be used when the user asks to "create a plugin", "scaffold a plugin", "understand plugin structure", "organize plugin components", "set up plugin.json", "use ${CLAUDE_PLUGIN_ROOT}", "add commands/agents/skills/hooks", "configure auto-discovery", or needs guidance on plugin directory layout, manifest configuration, component organization, file naming conventions, or Claude Code plugin architecture best practices.

anthropics/claude-plugins-official/plugins/plugin-dev/skills/plugin-structure 43kChecked 3h agoContent last changed 3h ago
A

plugin-structure

plugins/plugin-dev/skills/plugin-structure
100/100 · No meaningful risk foundNo security findings

This skill should be used when the user asks to "create a plugin", "scaffold a plugin", "understand plugin structure", "organize plugin components", "set up plugin.json", "use ${CLAUDE_PLUGIN_ROOT}", "add commands/agents/skills/hooks", "configure auto-discovery", or needs guidance on plugin directory layout, manifest configuration, component organization, file naming conventions, or Claude Code plugin architecture best practices.

Content hash
sha256:4d9ec1a29112b903636dee4f5cded020266e002aa028e81ff4f33e62cc7fc014
Files
7
Quality
100/100

Security findings

  • infoUnpinned package installSL501 · plugins/plugin-dev/skills/plugin-structure/examples/standard-plugin.md:485
    if ! npx eslint "$file" --quiet; then

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • README.md3.1 KB
  • SKILL.md13.5 KB
  • examples/advanced-plugin.md18.3 KB
  • examples/minimal-plugin.md1.7 KB
  • examples/standard-plugin.md13.0 KB
  • references/component-patterns.md11.8 KB
  • references/manifest-reference.md11.8 KB

Questions about plugin-structure

Is plugin-structure safe to install?
Our scanner gave plugin-structure grade A (100/100): no meaningful risk found. None of the 30 security rules matched. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
How do I install plugin-structure in Claude Code or Codex?
Run skillhash add github:anthropics/claude-plugins-official/plugins/plugin-dev/skills/plugin-structure. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
What happens if plugin-structure changes upstream?
Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.

More from anthropics/claude-plugins-official