Find and evaluate community skills, plugins, and marketplaces. Use when searching for existing skills, evaluating safety, or when "find skill", "discover plugin", "community skills", or "marketplace" are mentioned.
Find community skills and plugins, evaluate quality and safety before use.
<when_to_use>
NOT for: creating new skills (use skills-dev), validating your own skills (use skills-dev)
</when_to_use>
High-signal discovery starting points:
| Topic | Content | URL |
|-------|---------|-----|
| claude-code-plugin | Plugins | https://github.com/topics/claude-code-plugin |
| claude-code-plugin-marketplace | Marketplaces | https://github.com/topics/claude-code-plugin-marketplace |
| claude-code-skills | Skill packs | https://github.com/topics/claude-code-skills |
| claude-code-skill | Individual skills | https://github.com/topics/claude-code-skill |
Precise searches for specific artifacts:
# Find SKILL.md files in .claude/skills paths
filename:SKILL.md path:.claude/skills
# Find marketplace configurations
".claude-plugin/marketplace.json"
# Find plugin manifests
".claude-plugin/plugin.json"
# Find hook configurations
"PreToolUse" AND hooks
# Find skills with specific features
filename:SKILL.md "context: fork"
filename:SKILL.md "allowed-tools"
filename:SKILL.md "disable-model-invocation"
Focus on actively maintained projects (adjust dates as needed):
# Updated in last 90 days (calculate: date -v-90d +%Y-%m-%d)
pushed:>YYYY-MM-DD
# Updated since plugins era (Oct 2025+)
pushed:>2025-10-01
| Source | Trust Level | Notes | |--------|-------------|-------| | anthropics/claude-plugins-official | High | Curated, reviewed | | agentskills/agentskills | High | Spec + reference skills | | platform.claude.com docs | High | Official patterns | | Community topics | Medium | Popularity ≠ quality | | "Awesome" lists | Low-Medium | Curated but not audited |
| Signal | Good | Suspicious | |--------|------|------------| | Updates | Recent commits, active issues | Stale for 6+ months | | Stars | Steady growth | Sudden spike (star farming) | | Issues/PRs | Open and being addressed | Many open, no responses | | Install docs | Uses official commands | "curl | bash" installs | | Dependencies | Minimal, explained | Many unexplained deps |
| Check | Good | Bad |
|-------|------|-----|
| Description | Clear WHAT + WHEN + TRIGGERS | Vague "helps with files" |
| allowed-tools | Minimal, justified | Full tool access |
| disable-model-invocation | Used for side effects | Missing for deploy/commit |
| Scripts | Documented, minimal | Obfuscated, complex |
| Hooks | Obvious purpose | Hidden network calls |
| Good Sign | Red Flag | |-----------|----------| | Version pinning | Floating branches | | Listed sources visible | Opaque references | | Clear update policy | Silent auto-updates | | Curated with criteria | "Everything goes" |
Installing skills/plugins = running code. Treat with same care as npm packages.
| Surface | Risk | Mitigation |
|---------|------|------------|
| Skills with Bash | Command execution | Review allowed-tools |
| Hooks | Lifecycle interception | Review hook scripts |
| MCP servers | External connections | Review endpoints |
| Preprocessing ! | Shell before thinking | Review commands |
Before installing, review:
For Skills:
allowed-tools, disable-model-invocation)! ` preprocessing commandsFor Plugins:
For Hooks:
When running untrusted skills:
allowed-tools, expand as neededcontext: fork to limit blast radiusdisable-model-invocation: true initially# Test skill in restricted mode:
---
name: untrusted-skill-test
allowed-tools: Read, Grep, Glob # read-only first
context: fork # isolated
disable-model-invocation: true # explicit only
---
Expand permissions only after reviewing behavior.
Common skill categories with examples (for inspiration, not endorsement):
| Pattern | What It Does | Key Features |
|---------|--------------|--------------|
| PR workflows | Summarize, review, update PRs | Preprocessing with gh |
| Issue pipelines | Triage → implement → ship | Artifact-based state |
| Release automation | Preflight → deploy → verify | Side-effect gates |
| Pattern | What It Does | Key Features | |---------|--------------|--------------| | Spec gates | Verify scope before coding | Fork for clean analysis | | Adversarial review | Security-focused code review | Threat model in artifacts | | Refactor loops | Safe read-only explore first | Tool restrictions |
| Pattern | What It Does | Key Features | |---------|--------------|--------------| | Framework-specific | Rails, React, etc conventions | Nested skill discovery | | DB-aware | Schema injection for queries | Preprocessing with psql | | Platform integrations | Jira, Linear, GitHub | MCP or API wrappers |
| Pattern | What It Does | Key Features | |---------|--------------|--------------| | Safety nets | Block irreversible operations | PreToolUse hooks | | Hardstops | Require human acknowledgment | Exit code blocking | | Test gates | Enforce tests before commit | Hook enforcement |
| Pattern | What It Does | Key Features | |---------|--------------|--------------| | Memory plugins | Persist across sessions | MCP-backed storage | | Context ledgers | Rolling state in files | Hook-driven updates | | Constraint files | Minimal "always load" context | Shared conventions |
When you find a useful skill, extract patterns rather than copying wholesale:
ALWAYS:
NEVER:
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer