plugin-scanner

plugin-scanner is an agent for coding agents from jimmc414/claude-code-plugin-marketplace. It costs 41 tokens per session (970 once invoked), scanned D, original, MIT.

An agent that scans a Claude Code installation and lists its installed skills, agents, commands, hooks, and related configuration.

In plain words
What is it for?
Use it to inventory global and project-level components before selecting items to package or share.
Why use it?
It saves you from checking each installation directory by hand when you need to understand what components are available.

Agent

Part of the plugin-publisher plugin — 1 skill, 3 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/jimmc414/claude-code-plugin-marketplace/plugin-scanner
Clone the repo
git clone --depth 1 https://github.com/jimmc414/claude-code-plugin-marketplace

Or install plugin-publisher, the plugin that ships this one along with the rest of its 1 skill, 3 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for plugin-scanner

README.md
[![agentmods](https://agentmods.dev/badge/agents/jimmc414/claude-code-plugin-marketplace/plugin-scanner.svg)](https://agentmods.dev/agents/jimmc414/claude-code-plugin-marketplace/plugin-scanner)
Your own site
<a href="https://agentmods.dev/agents/jimmc414/claude-code-plugin-marketplace/plugin-scanner"><img src="https://agentmods.dev/badge/agents/jimmc414/claude-code-plugin-marketplace/plugin-scanner.svg" alt="Measured on agentmods" height="20"></a>
Per session 41 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 970 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00041 $0.00970
Opus 5 $0.00020 $0.00485
Sonnet 5 $0.00008 $0.00194
Haiku 4.5 $0.00004 $0.00097

Measured yesterday against content hash b8e5e14f10a0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

plugin-scanner scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

cat ~/.claude/settings.json 2>/dev/null | head -100

Reads MCP configurationmediumAgent snooping

mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.

cat ~/.claude/mcp.json 2>/dev/null | head -50

Enumerates other installed skillsmediumAgent snooping

Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.

ls -la ~/.claude/skills/ 2>/dev/null
plugins/plugin-publisher/agents/plugin-scanner.md · 163 lines

How it starts

The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Plugin Scanner Agent

You are a specialized agent that scans a user's Claude Code installation to discover and inventory all installed components.

When Invoked

Step 1: Announce Scan

Tell the user you're scanning their Claude Code installation for components.

Step 2: Scan Global Installation

Scan the user's home directory for Claude Code components:

# Skills (directories with SKILL.md)
ls -la ~/.claude/skills/ 2>/dev/null

# Agents (markdown files)
ls -la ~/.claude/agents/ 2>/dev/null

# Commands (markdown files)
ls -la ~/.claude/commands/ 2>/dev/null

# Settings (for hooks)
cat ~/.claude/settings.json 2>/dev/null | head -100

# MCP Servers
cat ~/.claude/mcp.json 2>/dev/null | head -50

Step 3: Scan Project-Level (if in a project)

Check if current directory has local Claude config:

# Project skills
ls -la .claude/skills/ 2>/dev/null

# Project agents
ls -la .claude/agents/ 2>/dev/null

# Project commands
ls -la .claude/commands/ 2>/dev/null

# Project settings
cat .claude/settings.json 2>/dev/null

Step 4: Build Component Inventory

For each discovered component, extract key information:

For Skills:

  • Read the SKILL.md file
  • Extract name from frontmatter
  • Extract description from frontmatter
  • Note the allowed-tools

For Agents:

  • Read the .md file
  • Extract name from frontmatter
  • Extract description from frontmatter
  • Note the tools and model

For Commands:

  • Read the .md file
  • Extract description from frontmatter
  • Note the argument-hint

For Hooks:

  • Parse settings.json
  • List each hook type and what it triggers
  • Note associated scripts

Step 5: Detect Relationships

Look for related components that should be packaged together:

  1. Name patterns: Components with shared prefixes (e.g., parallel-orchestrator, parallel-worker)
  2. Cross-references: Components that mention each other in their content
  3. Shared domains: Components dealing with the same technology

Group related components and suggest they be packaged together.

Read the full file on GitHub · 163 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 163 lines · 41 tokens per session scan D b8e5e14f10a0

Subscribe to this mod's changes

plugin-scanner is an agent published in the GitHub repository jimmc414/claude-code-plugin-marketplace (4 stars, last pushed today), licensed MIT. It adds 41 tokens to every session and 970 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 3 findings (reads agent configuration directories, reads mcp configuration, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.

Related

Other agents, from other repositories

security-reviewer

Cross-ecosystem security audit specialist. Proactively reviews code for vulnerabilities static analysis misses — logic flaws, architectural security gaps, ecosystem-specific pitfalls. Use when modifying authentication, authorization, data handling, API endpoints, or any code processing user input, and before PRs…

melodic-software/claude-code-plugins · 62 tokens

architecture-guardian

Architecture enforcement specialist. Reviews code for dependency-direction violations, layer boundary breaches, pattern compliance, and structural integrity. Use when adding new projects or modules, modifying project references, creating cross-module interactions, or before PRs touching architecture-significant code.

melodic-software/claude-code-plugins · 53 tokens

implementer

Scope-fenced implementation worker dispatched per phase by /implementation:implement-dispatch (directly, or chained from callers such as /work-items:work): executes exactly one brief inside its assigned or self-provisioned worktree, commits and pushes early, and returns a verdict plus identifiers. Not intended for…

melodic-software/claude-code-plugins · 70 tokens

explorer

Runs the full /discovery:explore workflow in a fresh context and persists the EXPLORE.md index plus its sidecars into the topic's memory slice, returning a file pointer and a bounded summary rather than the file reads and search output. Dispatched by /discovery:explore; not intended for direct ad-hoc use.

melodic-software/claude-code-plugins · 72 tokens

intent-tracer

Runs the full /discovery:trace-intent discipline in a fresh context and persists the INTENT.md index plus its sidecars into the topic's memory slice, returning a file pointer and a verification request rather than the review threads, tickets and documents it read. Dispatched by /discovery:trace-intent; not intended…

melodic-software/claude-code-plugins · 77 tokens

researcher

Runs the full /discovery:research discipline in a fresh context and persists the RESEARCH.md index plus its sidecars into the topic's memory slice, returning a file pointer and a verification request rather than the research transcript. Dispatched by /discovery:research and by /discovery:research-deep; not intended…

melodic-software/claude-code-plugins · 75 tokens