plugin-browser

A browser for discovering community and official Claude Code skills, agents, commands, and plugins. It searches a catalog of indexed repositories and their contents.

In plain words
What is it for?
Use it to search for relevant extensions, inspect repository descriptions and topics, and explore their available skills, agents, commands, or plugins.
Why use it?
It helps locate existing add-ons when you need a capability but do not know which repository or package provides it.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/berekvolgyipeter/dotclaude/plugin-browser
Any agent
npx skills add berekvolgyipeter/dotclaude --skill plugin-browser
Clone the repo
git clone --depth 1 https://github.com/berekvolgyipeter/dotclaude

Made for: Claude Code, Codex.

Per session 96 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 859 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00096 $0.00859
Opus 5 $0.00048 $0.00430
Sonnet 5 $0.00019 $0.00172
Haiku 4.5 $0.00010 $0.00086

Measured 2d ago against content hash bc1c6a683283, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

plugin-browser scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 13 executable files (scripts/clone-references.sh, scripts/clone-references/clone-anthropics-claude-plugins-official.sh, scripts/clone-references/clone-anthropics-knowledge-work-plugins.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/plugin-browser/SKILL.md · 72 lines

How it starts

The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Plugin Browser

Help users discover and explore skills, agents, commands, and plugins from community and official repositories.

Catalog

The catalog at ~/.claude/skills/plugin-browser/references/catalog.json lists all indexed repositories with descriptions and topics. Read it first to understand what's available and which repo is most relevant to the user's need.

Each entry has these fields: github (source repo), local_path (where it's cloned), description (what it contains), topics (keyword tags), and content_types (e.g. skills, agents, commands, plugins).

All repos are cloned and indexed together under a single path:

~/.claude/skills-references/plugin-browser/

Each repo lives at the local_path specified in the catalog (e.g., ~/.claude/skills-references/plugin-browser/wshobson-agents/).

Always start with semantic search — it combines semantic understanding with BM25 keyword matching, so it surfaces conceptually relevant results even when exact keywords differ. Only fall back to Grep if semantic search returns no results or the index is unavailable.

Primary — semantic search:

mcp__claude-context__search_code(
  path="~/.claude/skills-references/plugin-browser",
  query="<user need>"
)

Fallback — keyword search (only when semantic search fails or is unavailable):

Grep(pattern="<keyword>", path="~/.claude/skills-references/plugin-browser/", glob="*.md")

Browse

To list contents of a specific plugin or repo:

Glob(~/.claude/skills-references/plugin-browser/<repo-dir>/**/*.md)

For structured plugin repos (like wshobson-agents), check for a marketplace.json or plugin.json for richer metadata:

Glob(~/.claude/skills-references/plugin-browser/<repo-dir>/**/*marketplace*.json)
Glob(~/.claude/skills-references/plugin-browser/<repo-dir>/**/*plugin*.json)

Workflow

  1. Understand the need — ask clarifying questions if the user's request is vague (e.g., "security" could mean AppSec scanning, smart contract auditing, or secrets detection).
  2. Catalog — read ~/.claude/skills/plugin-browser/references/catalog.json to identify which repos are relevant based on descriptions and topics.
  3. Search — use semantic search to find matching components across all repos.
  4. Read before recommending — read the component's SKILL.md, README, or plugin.json before presenting it. Understand what it does, what tools it needs, and any dependencies.
  5. Present matches — show name, description, source repo, and category. When multiple options exist, compare them briefly.
  6. Review for safety — before installing, warn the user that community plugins are third-party content. They may request broad tool permissions, modify settings or permission files, execute shell commands via hooks, or overwrite existing configuration. Advise the user to review the plugin's contents (especially allowed-tools, hooks, and any shell scripts) before proceeding.
  7. Install (if requested) — copy selected files into the user's .claude/ directory (skills, agents, commands). Confirm before copying and warn if destination files already exist. Browse the repo's directory layout first to determine the correct source paths, since not all repos follow the same structure.

Read the full file on GitHub · 72 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 72 lines · 96 tokens per session scan A bc1c6a683283

Subscribe to this mod's changes

plugin-browser is a skill published in the GitHub repository berekvolgyipeter/dotclaude (2 stars, last pushed 20d ago), licensed MIT. It adds 96 tokens to every session and 859 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.