Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/miles990/claude-software-skills/claude-code-pluginnpx skills add miles990/claude-software-skills --skill claude-code-plugingit clone --depth 1 https://github.com/miles990/claude-software-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/miles990/claude-software-skills/claude-code-plugin)<a href="https://agentmods.dev/skills/miles990/claude-software-skills/claude-code-plugin"><img src="https://agentmods.dev/badge/skills/miles990/claude-software-skills/claude-code-plugin.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.04041 |
| Opus 5 | $0.00012 | $0.02021 |
| Sonnet 5 | $0.00005 | $0.00808 |
| Haiku 4.5 | $0.00002 | $0.00404 |
Grade D, and why
claude-code-plugin scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat ~/.claude/plugins/installed_plugins.json | jq '.plugins["plugin@marketplace"][0].version' Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$PLUGIN_REPO/skills" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://raw.githubusercontent.com/owner/repo/main/.claude-plugin/plugin.json | jq -r '.version' How it starts
The opening of the file, as written. The whole thing — 625 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Code Plugin 完整指南
建立、發布、安裝、更新、同步 Claude Code Plugin 的完整指南
適用場景
- 開發新的 Claude Code Plugin
- 發布 Plugin 到 Marketplace
- 安裝和更新 Plugin
- 管理 Plugin 版本
- 同步最新版本
- 建立自訂 Marketplace
Part 1: Plugin 架構
目錄結構
my-plugin/
├── .claude-plugin/
│ ├── plugin.json # Plugin manifest(必要)
│ └── marketplace.json # Marketplace 索引(選用)
├── commands/ # Slash 命令(在根目錄!)
│ └── my-command.md
├── skills/ # Agent Skills
│ └── my-skill/
│ └── SKILL.md
├── hooks/
│ └── hooks.json # Hook 配置
├── agents/ # Subagent 定義
├── .mcp.json # MCP 伺服器配置
├── CHANGELOG.md
└── README.md
⚠️ 重要:commands/、skills/、hooks/ 必須在根目錄,不要放進 .claude-plugin/
plugin.json 規範
{
"name": "my-plugin",
"version": "1.0.0",
"description": "Plugin 功能描述",
"author": {
"name": "作者名稱",
"email": "[email protected]"
},
"license": "MIT",
"keywords": ["keyword1", "keyword2"]
}
四大組件
| 組件 | 用途 | 觸發方式 | 檔案格式 |
|---|---|---|---|
| Commands | 用戶執行的斜線命令 | /command 手動 |
Markdown |
| Skills | 教 Claude 如何做事 | 自動根據上下文 | SKILL.md |
| Hooks | 事件驅動自動化 | 系統事件觸發 | JSON + Shell |
| MCP | 提供工具能力 | Claude 呼叫 | .mcp.json |
Part 2: 發布 Plugin
方式一:GitHub Marketplace(推薦)
Step 1: 建立 marketplace.json
{
"$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
"name": "my-marketplace",
"description": "我的 Plugin 集合",
"owner": {
"name": "username",
"email": "[email protected]"
},
"plugins": [
{
"name": "my-plugin",
"version": "1.0.0",
"source": "./",
"description": "Plugin 描述",
"category": "development"
}
]
}
Step 2: 推送到 GitHub
git add .
git commit -m "feat: add Plugin marketplace format"
git tag -a v1.0.0 -m "Release v1.0.0"
git push origin main
git push origin v1.0.0
Step 3: 用戶安裝
# 添加 marketplace
/plugin marketplace add owner/repo
# 安裝 plugin
/plugin install my-plugin@my-marketplace
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 625 lines · 23 tokens per session scan D c4ae108120d5
claude-code-plugin is a skill published in the GitHub repository miles990/claude-software-skills (20 stars, last pushed 7mo ago), licensed MIT. It adds 23 tokens to every session and 4,041 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it D with 3 findings (reads agent configuration directories, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
plugin-publish
发布 Zhin.js 插件到 npm 和 Zhin 插件市场。Use when asked to publish a plugin, prepare for release, check publish readiness, or submit to the Zhin plugin marketplace. 引导完成发布前检查、版本管理和提交流程。.
flow-next-interview
In-depth Q&A to refine a spec, task, or spec file before building. Use when asked to flesh out, refine, or interrogate requirements.
flow-next-audit
Audit .flow/memory/ entries against current code and keep, update, consolidate, replace, delete, or harden each. Use when asked to audit memory or graduate a recurring lesson into a gate.
flow-next-capture
Synthesize the current conversation into a flow-next spec with read-back gating. Use when asked to capture this as a spec.
flow-next-drive
Drive any UI surface like a real user - a web app, a Chromium-backed desktop app (Electron / WebView2, reached over CDP), or a genuinely native app (macOS AppKit/SwiftUI, or a non-CDP webview) reached via the Cua Driver / Computer Use. Detects the surface, picks the best available driver, degrades gracefully. Use to…
flow-next-impl-review
Carmack-level implementation review of changes via the configured backend. Use when asked to review code or a diff in a flow-next repo.