Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/berekvolgyipeter/dotclaude/plugin-browsernpx skills add berekvolgyipeter/dotclaude --skill plugin-browsergit clone --depth 1 https://github.com/berekvolgyipeter/dotclaudeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00096 | $0.00859 |
| Opus 5 | $0.00048 | $0.00430 |
| Sonnet 5 | $0.00019 | $0.00172 |
| Haiku 4.5 | $0.00010 | $0.00086 |
Grade A, and why
plugin-browser scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin Browser
Help users discover and explore skills, agents, commands, and plugins from community and official repositories.
Catalog
The catalog at ~/.claude/skills/plugin-browser/references/catalog.json lists all indexed repositories with descriptions and topics. Read it first to understand what's available and which repo is most relevant to the user's need.
Each entry has these fields: github (source repo), local_path (where it's cloned), description (what it contains), topics (keyword tags), and content_types (e.g. skills, agents, commands, plugins).
All repos are cloned and indexed together under a single path:
~/.claude/skills-references/plugin-browser/
Each repo lives at the local_path specified in the catalog (e.g., ~/.claude/skills-references/plugin-browser/wshobson-agents/).
Search
Always start with semantic search — it combines semantic understanding with BM25 keyword matching, so it surfaces conceptually relevant results even when exact keywords differ. Only fall back to Grep if semantic search returns no results or the index is unavailable.
Primary — semantic search:
mcp__claude-context__search_code(
path="~/.claude/skills-references/plugin-browser",
query="<user need>"
)
Fallback — keyword search (only when semantic search fails or is unavailable):
Grep(pattern="<keyword>", path="~/.claude/skills-references/plugin-browser/", glob="*.md")
Browse
To list contents of a specific plugin or repo:
Glob(~/.claude/skills-references/plugin-browser/<repo-dir>/**/*.md)
For structured plugin repos (like wshobson-agents), check for a marketplace.json or plugin.json for richer metadata:
Glob(~/.claude/skills-references/plugin-browser/<repo-dir>/**/*marketplace*.json)
Glob(~/.claude/skills-references/plugin-browser/<repo-dir>/**/*plugin*.json)
Workflow
- Understand the need — ask clarifying questions if the user's request is vague (e.g., "security" could mean AppSec scanning, smart contract auditing, or secrets detection).
- Catalog — read
~/.claude/skills/plugin-browser/references/catalog.jsonto identify which repos are relevant based on descriptions and topics. - Search — use semantic search to find matching components across all repos.
- Read before recommending — read the component's SKILL.md, README, or plugin.json before presenting it. Understand what it does, what tools it needs, and any dependencies.
- Present matches — show name, description, source repo, and category. When multiple options exist, compare them briefly.
- Review for safety — before installing, warn the user that community plugins are third-party content. They may request broad tool permissions, modify settings or permission files, execute shell commands via hooks, or overwrite existing configuration. Advise the user to review the plugin's contents (especially
allowed-tools, hooks, and any shell scripts) before proceeding. - Install (if requested) — copy selected files into the user's
.claude/directory (skills, agents, commands). Confirm before copying and warn if destination files already exist. Browse the repo's directory layout first to determine the correct source paths, since not all repos follow the same structure.
What ships with it
15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 1.3 KB
- references/catalog.json 13 KB
- scripts/clone-references.sh 299 B runs code
- scripts/clone-references/clone-anthropics-claude-plugins-official.sh 916 B runs code
- scripts/clone-references/clone-anthropics-knowledge-work-plugins.sh 909 B runs code
- scripts/clone-references/clone-coreyhaines31-marketingskills.sh 853 B runs code
- scripts/clone-references/clone-everyinc-compound-engineering.sh 918 B runs code
- scripts/clone-references/clone-ghostsecurity-skills.sh 835 B runs code
- scripts/clone-references/clone-mattpocock-skills.sh 819 B runs code
- scripts/clone-references/clone-obra-superpowers.sh 797 B runs code
- scripts/clone-references/clone-openai-skills.sh 751 B runs code
- scripts/clone-references/clone-trailofbits-skills-curated.sh 861 B runs code
- scripts/clone-references/clone-trailofbits-skills.sh 805 B runs code
- scripts/clone-references/clone-wshobson-agents.sh 783 B runs code
- scripts/index-references.sh 195 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 72 lines · 96 tokens per session scan A bc1c6a683283
plugin-browser is a skill published in the GitHub repository berekvolgyipeter/dotclaude (2 stars, last pushed 20d ago), licensed MIT. It adds 96 tokens to every session and 859 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
api-caching-strategies
Application-level caching strategies, HTTP caching, cache invalidation, and stampede prevention.
api-framework-express
Express.js routes, middleware, error handling, request/response patterns.
api-analytics-setup-posthog
PostHog analytics and feature flags setup.
tokenless
Use when a task can be delegated through the globally installed Tokenless CLI without directly writing to the workspace; route it to a visible AI provider website to save agent tokens.
tokenless-install
Install, upgrade, repair, and verify Tokenless, its agent skills, and local Playwright runtime. Use only when the user explicitly asks for installation, upgrade, repair, browser sign-in handoff, a failed doctor check, or an installation integrity check.
performance-profiling
A measurement-first approach to finding and fixing performance problems in web apps, covering Core Web Vitals targets, a baseline-isolate-fix-verify loop, bundle and runtime/memory analysis, and prioritized quick wins. Use it when diagnosing slow loads or interactions, running Lighthouse audits, inspecting bundle…