Vibe Coding using Claude Code/Power Features
Lesson 8 / 8 · 16 min · 0 / 3 exercises
Course contents
Walkthrough · 3 hands-on exercises

Plugins and Marketplaces

Install a bundle of skills, agents, hooks and MCP servers in one step, choose who gets it, review a plugin before you trust it, and package your own setup for a team.

A plugin is a folder of components that Claude Code installs and loads as one unit: skills, subagents, hooks, MCP servers and more, plus a manifest at .claude-plugin/plugin.json that names it. A marketplace is a catalog of plugins, defined by a .claude-plugin/marketplace.json in a repository. It's a list of where to fetch each plugin, not a hosted store. You add a marketplace once, then install plugins from it by name, such as commit-commands@claude-plugins-official. A plugin's skills appear as /plugin-name:skill-name.

You don't need a plugin to use any single component; a skill in ~/.claude/skills/ works on its own. Plugins earn their keep when several pieces belong together, when you want someone else's setup in one command with updates from its marketplace, or when you want to hand your own setup to a team with versioned releases.

MarketplaceName you type after @What's in itHow you get it
Officialclaude-plugins-officialPlugins Anthropic maintains, such as commit-commands, code-review and the language-server plugins, plus plugins from partnersAdded automatically the first time you start an interactive session
Communityclaude-communityThird-party plugins their authors submitted to Anthropic/plugin marketplace add anthropics/claude-plugins-community
Any otherWhatever its file names itA coworker's, your company's or a vendor's catalog/plugin marketplace add <owner>/<repo>

Installing asks for a scope. User scope gives you the plugin in every project on this machine (recorded in ~/.claude/settings.json). Project scope enables it for everyone in the repository through .claude/settings.json; committing that entry turns it on for collaborators, and each of them installs it once per clone. Local scope gives it to you in this repository only. When scopes disagree, local wins over project and project over user.

Sort itExercise 1 of 3

Package it as a plugin, or keep it standalone?

Card 1 of 4

Your team's reviewer agent, its review skill and a pre-commit hook, versioned together

Review before you trust

The docs are blunt: a plugin you install can execute arbitrary code on your machine with your user privileges. Its hooks run as shell commands, its monitors run in the background, its MCP and language servers start as processes, and anything in its bin/ folder lands on the PATH of Claude's shell. Your permission rules and the sandbox cover the tool calls Claude makes, not the code a plugin runs by itself. Its skills and agents enter Claude's context as instructions. And if auto-update is on for its marketplace, the files you reviewed can change on disk later.

Names help a little. Claude Code accepts the official and community marketplace names only for catalogs sourced from Anthropic's own GitHub repositories, so a third party can't pose as one. But a marketplace's name tells you who publishes the catalog, not what each plugin does. Before you install, open the plugin in /plugin and read its hooks, servers and binaries. Plugins in the official marketplace also show a Context cost estimate.

Spot the problemsExercise 2 of 3

You're reviewing a “quick-lint” plugin from a marketplace you don't know. Find the three components you'd want explained before installing.

quick-lint plugin contents0 of 3 found
Quick checkExercise 3 of 3

You install a plugin and your permission rules deny Bash(curl *). Does that stop the plugin's own SessionStart hook from running curl?

Steps · 0 / 6 done

  1. Browse what's available

    Open the plugin menu. The Discover tab lists plugins from your marketplaces.

    prompt
    /plugin
    VerifyThe menu opens with Discover, Installed and Marketplaces tabs, and claude-plugins-official is listed.

  2. Install one

    Install with the plugin's name and marketplace. In a session this opens the plugin's details first, so you can review it and choose a scope.

    prompt
    /plugin install commit-commands@claude-plugins-official
    VerifyAfter you pick a scope, an install summary prints. From your shell, claude plugin list shows the plugin with its version, scope and status.

  3. Find its skills

    Type / followed by the plugin's name to see the skills it added.

    prompt
    /commit-commands:
    VerifyThe menu lists the plugin's skills, each prefixed with commit-commands:.

  4. Add a second marketplace

    Add Anthropic's community catalog. Remember that its plugins are third-party.

    prompt
    /plugin marketplace add anthropics/claude-plugins-community
    VerifyThe Marketplaces tab now lists claude-community.

  5. Build a plugin of your own

    Create the smallest possible plugin: a manifest and one skill. In my-first-plugin/.claude-plugin/plugin.json, put {"name": "my-first-plugin", "version": "1.0.0"}. Add skills/hello/SKILL.md with a description, then validate and load it for one session.

    bash
    mkdir -p my-first-plugin/.claude-plugin my-first-plugin/skills/hello
claude plugin validate ./my-first-plugin
claude --plugin-dir ./my-first-plugin
    VerifyValidation prints ✔ Validation passed, and /my-first-plugin:hello runs in the session. After editing the plugin, /reload-plugins applies the change.

  6. Turn one off without uninstalling

    An enabled plugin adds to every session, so disable the ones you aren't using.

    bash
    claude plugin disable commit-commands
    Verifyclaude plugin list shows the plugin as disabled, and its skills no longer appear in the / menu.
Check your understanding
Q1. What does a plugin marketplace give you?
Q2. Your team wants a plugin enabled for everyone who works in a repository. Which scope?
· Tick off the 6 step(s) above.
· Work through the 3 remaining exercises above (stuck? each one can show you the answer).
· Score 100% on the quiz.
Vocabulary in this lesson
SkillA named, reusable procedure the agent loads on demand: a folder of instructions and optional scripts, used when a task matches.MCPModel Context Protocol: an open standard for plugging external tool servers into any agent harness.SessionOne continuous run with an agent, from an empty context to the moment you clear it, close it, or hand its work off.HooksCommands you configure the harness to run at fixed moments, such as before or after a tool call, regardless of what the model wants.SandboxAn isolated place for the agent to run, such as a container, VM or restricted shell, so a bad action can't reach the rest of your machine.Tool callThe model's request to run a tool: a structured message naming the tool and its arguments, which the harness then executes.

Plain-English definitions from the AI Coding Dictionary.