Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add bvdr/claude-pluginsnpx agentmods add plugins/bvdr/claude-plugins/marketplacegit clone --depth 1 https://github.com/bvdr/claude-pluginsGrade A, and why
bvdr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "bvdr",
"owner": {
"name": "Bogdan Dragomir",
"url": "https://github.com/bvdr"
},
"description": "Custom Claude Code plugins for macOS productivity and development workflows",
"plugins": [
{
"name": "bvdr",
"source": "./plugins/bvdr",
"description": "Claude Code skills collection: proof-driven development workflow, cmux orchestration (/control), Umami Analytics, Slack notifications, statusline setup, voice alerts, Gemini evaluation, and more",
"version": "1.4.0"
},
{
"name": "bvdr-interactive-notifications",
"source": "./plugins/bvdr-interactive-notifications",
"description": "macOS interactive dialogs for Claude Code permissions and questions - respond from anywhere without switching to terminal",
"version": "1.0.0"
},
{
"name": "bvdr-smart-permissions",
"source": "./plugins/bvdr-smart-permissions",
"description": "AI-powered permission hook that auto-approves safe operations and auto-denies dangerous ones",
"version": "2.0.0"
},
{
"name": "bvdr-nightshift",
"source": "./plugins/bvdr-nightshift",
"description": "Autonomous deep codebase audit with 2-level swarm. 9 Level 1 audit domains + 6 Level 2 enhancement agents. Stop/resume, dashboard report, trend tracking, Slack/Notion integration.",
"version": "2.1.0"
},
{
"name": "bvdr-ideation-and-roadmap",
"source": "./plugins/bvdr-ideation-and-roadmap",
"description": "Deep AI-powered project ideation, marketing audit, and roadmap generation with parallel subagents, competitive analysis, analytics integration, and interactive HTML reports",
"version": "1.1.0"
}
]
}
What ships with it
1 file beside marketplace.json in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 41 lines scan A 826fa9037bd2
bvdr is a plugin published in the GitHub repository bvdr/claude-plugins (3 stars, last pushed 2mo ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
wondelai-skills
Wondel.ai Agent Skills — Business, Marketing, UX & Coding Frameworks from Bestselling Books. 65 skills for product strategy, UX design, marketing, sales, motivation, conversion optimization, code quality, and systems architecture, plus 14 guided-journey metaskills that orchestrate them step by step.
netresearch-claude-code-marketplace
Curated Agentic Skills for AI coding agents — TYPO3, PHP, Go, Docker, Jira, security, and more. Platform-agnostic skills following the open Agent Skills specification.
backend-architecture
Small, opinionated architecture guide for production backend services across languages and frameworks.
backend-validator
Backend API and WebSocket validation via Hurl, websocat, and oauth2c with OIDC token caching.
code-cleanup
Evidence-first cleanup of agent trajectory residue, dead islands, split-brain authority, stale dependencies, and unnecessary code across repositories.
esp32-cpp
Evidence-first ESP32 firmware guidance for hardware, FreeRTOS, memory, peripherals, and field failures.