Search skills/

Claude Plugins Official Claude skills

Anthropic's official Claude Code plugin marketplace: first-party plugins such as skill-creator and plugin-dev, plus external channel plugins.

anthropics/claude-plugins-official 33 skills Planning, TDD & debuggingSkill & agent tooling
Our verdict Recommended with caveats

A trustworthy source for Anthropic's own plugins, but it is a catalog: each plugin, especially the external chat-channel ones, needs its own review and license check.

3/5 Depth expertise shipped ! Security Broad access 0d Maintenance Updated today 45K Adoption stars OK License Apache-2.0, commercial OK

What Claude Plugins Official does

This repo is the official plugin directory that Claude Code uses as its default marketplace, so you install from it with /plugin install <name>@claude-plugins-official. It holds two kinds of entries. Under plugins/ are plugins written by Anthropic staff, in our snapshot sixteen of them: skill-creator (create, test and benchmark skills, with Python eval scripts), plugin-dev (guides for hooks, commands, agents and MCP integration), mcp-server-dev, hookify (rules that block or warn on tool calls), claude-md-management, claude-code-setup (recommends hooks, subagents and MCP servers for a codebase), frontend-design, playground, project-artifact, a claude-security scanner and patcher, math-olympiad and math-proof, session-report and receipts (usage reports built from local transcripts), and an example plugin.

Under external_plugins/ are partner plugins; the snapshot includes Discord, iMessage and Telegram channel plugins whose skills manage pairing codes, allowlists and bot tokens kept in ~/.claude/channels/. Thirty-three SKILL.md files average about 13 KB, with references and examples in the developer-facing plugins. The README says each plugin has its own license, and warns that Anthropic does not control what MCP servers, files or other software a plugin contains or whether it will change. Treat it as a catalog and install individual plugins after reading them.

Good for

  • Finding Anthropic-maintained plugins for Claude Code in one place
  • Building your own skills, hooks or MCP servers with skill-creator, plugin-dev and mcp-server-dev
  • Reviewing how official plugins are structured before writing your own

Not for

  • Installing everything at once (each plugin has different permissions and licenses)
  • Agents other than Claude Code, since the plugin format is Claude Code specific

What's inside depth 3/5

33 SKILL.md files averaging about 13 KB, with references, examples and eval scripts in the developer-facing plugins, but quality and depth vary from plugin to plugin.

Skills
33
Reference docs
57
Scripts
25
Tests / evals
6
Templates
23
Avg SKILL.md
12.5 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Claude Code with plugin support
  • For channel plugins: a Discord bot token, Telegram bot or iMessage access
  • Node and Python for plugins that ship scripts (receipts, skill-creator)
  • Telemetry: none found in the plugins we reviewed; the receipts and session-report plugins read local transcripts and, per their descriptions, make no extra API calls beyond the final write-up.

Security review

Broad access

This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.

  • Pre-approves broad shell commandsPre-approves Bash(git *) (any git subcommand, including push) alongside Write, Edit and Workflow/Agent tools; the other Bash entries are narrow (date, ls, wc, mkdir -p).plugins/claude-security/skills/claude-security/SKILL.md:4

Anthropic's official plugin collection: developer tooling (plugin-dev, skill-creator, hookify, MCP server builders), analysis plugins that read your local session transcripts (receipts, session-report), a code-security scanner, math proof workflows and Telegram/Discord/iMessage channel plugins. Most skills use narrow Bash pre-approvals; claude-security pre-approves Bash(git *). The channel plugins store a bot token under ~/.claude/channels and warn that channel messages can carry prompt injection, but their server code was not in our files.

Worth knowing

  • Changes files outside your projectThe Telegram, Discord and iMessage channel skills write a bot token to ~/.claude/channels/<channel>/.env (chmod 600) and an access.json allowlist; their Bash pre-approvals are narrow (ls, mkdir, echo, chmod).external_plugins/telegram/skills/configure/SKILL.md:16
  • Relies on a CLI or package we could not reviewskill-creator scripts launch claude -p as a subprocess (with CLAUDECODE unset) for trigger evals and description improvement, and open a local review server on 127.0.0.1; the channel plugins' servers and the Claude CLI are not in these files.plugins/skill-creator/skills/skill-creator/scripts/run_eval.py:70

What we checked

The repository (595 files) on Oct 29, 2026. Not a full review: 426 of 595 files were not downloaded (large repository; we reviewed the skill folders); we read 0 of 25 code files; it relies on code outside the repository: 426 of 595 files were not downloaded, including .claude-plugin/marketplace.json, the channel plugin servers (discord, imessage, telegram) and the GitHub workflow scripts; the 25 listed code files were pattern-scanned (subprocess, network, file-delete, server, environment use); none were read line by line.

NVIDIA SkillSpector static scan: 147 pattern hits (Privilege Escalation 28, Agent Snooping 23, MCP Rug Pull 21, Excessive Agency 16, Tool Misuse 16, Data Exfiltration 16). The 147 hits are mostly teaching material: plugin-dev and hookify examples with rm -rf, sudo, chmod 777, .env and credentials.json patterns, example.com URLs, MCP/auth documentation, and 'Enable Developer Mode' in the Discord setup text. The claude-security 'without warning' hit is an instruction about reporting. Real behaviours (pre-approved Bash, token storage, claude -p subprocesses) are recorded as flags.

A review, not a certification. Skills change after we check them — read the files before installing.

License

Apache-2.0 for the repo, but the README says to check each linked plugin's own LICENSE file.

Can it run unattended?

Not really. It is a directory of mixed plugins; a few, like math-proof, orchestrate multi-round agent work, but there is no shared unattended workflow.

Alternatives to Claude Plugins Official

Anthropic Agent Skills

anthropics/skills

Anthropic's reference skills repo: 20 skills including document tools (docx, pptx, xlsx, pdf), frontend-design, skill-creator and mcp-builder.

Recommended Check first Depth 4/5

Claude for Financial Services

anthropics/financial-services

Anthropic's reference agents, skills and data connectors for banking, research, fund admin and KYC, usable as Claude plugins or Managed Agents.

With caveats Check first Depth 3/5

Compound Engineering

EveryInc/compound-engineering-plugin

Every's plugin of 36 skills for a brainstorm, plan, build, review and capture-the-learning loop, with an optional hands-off /lfg pipeline.

Recommended Broad access Depth 4/5

wshobson/agents

wshobson/agents

A multi-harness plugin marketplace with 94 plugins, 202 agents, 185 skills and 105 commands for Claude Code, Codex, Cursor, OpenCode, Copilot, Antigravity and Pi.

With caveats Check first Depth 2/5

FAQ

What is the claude-plugins-official repo?

It is Anthropic's managed directory of Claude Code plugins, containing plugins written by Anthropic and external plugins from partners and the community. Claude Code uses it as the default marketplace for /plugin install commands.

How do I install a plugin from the official marketplace?

Run /plugin install {plugin-name}@claude-plugins-official in Claude Code, or browse with /plugin and the Discover tab. For example, skill-creator and plugin-dev are both in this directory.

Are the official Claude plugins safe?

The first-party plugins we read contain instructions and local scripts without hidden network calls. The README itself warns that Anthropic does not control what MCP servers or software a plugin includes and that contents can change, so review a plugin before installing it, especially channel plugins that hold bot tokens.

What is the difference between plugins and skills?

A skill is a SKILL.md instruction folder; a plugin is a package that can bundle skills with commands, agents, hooks and MCP server configuration. This repo lists plugins, many of which contain skills.

Sources: GitHub repository (stars, license, file tree, last push Oct 29, 2026). Review based on the README and SKILL.md files as published.