Claude Code Plugins & the Marketplace — talk-prep brief

TL;DR for the session. A Claude Code plugin is a packaging unit — a directory bundling any of skills, agents, slash commands, hooks, MCP servers, LSP servers — installed via /plugin from a marketplace (a marketplace.json catalog hosted on GitHub or anywhere reachable). The official Anthropic marketplace ships automatically (~101 plugins, 33 Anthropic + 68 partner as of May 2026) [20]; the community marketplace is one /plugin marketplace add away, with submissions gated by automated safety screening [7]. Spend ~25 min on anatomy and install flow, ~15 min on building/distributing your own, and ~15 min on the trust boundary — plugins execute arbitrary code with the user’s privileges, and there is already a CVE history to point to [13].

This brief is the third in a series (prior: AI Security, Skills). It assumes the audience already understands what a Skill is and links plugins back to the security material where natural.

1. What a plugin is — and isn’t

Anthropic announced plugins on 9 Oct 2025 as a lightweight way to package and share the building blocks people were already cobbling together [1]. The mental model the docs push, and the line worth repeating verbatim in the talk:

Plugins are the distribution format; skills are the content. You install plugins; you use skills. [10]

A plugin can bundle any combination of:

The whole thing is identified by .claude-plugin/plugin.json:

{
  "name": "my-first-plugin",
  "description": "Greets the user",
  "version": "1.0.0",
  "author": { "name": "Your Name" }
}

Only name is truly required; version is optional but recommended — without it, every git commit counts as a new version [3].

Common landmine to demo live: commands/, agents/, skills/, hooks/ go at the plugin root, not inside .claude-plugin/. The docs flag this explicitly [3].

2. The marketplaces — three tiers, one schema

A marketplace is just a git repo (or any URL) with a .claude-plugin/marketplace.json listing plugins, each with name, description, source, and category [4]. The schema is published at schemastore.org/claude-code-marketplace.json.

Partner integrations in the official marketplace (worth name-dropping when introducing): GitHub, GitLab, Atlassian, Asana, Linear, Notion, Figma, Vercel, Firebase, Supabase, Slack, Sentry, Stripe, Playwright, Auth0, Datadog, Cloudflare, and an aws-* family (aws-core, aws-amplify, aws-serverless, …) [6] [20].

3. The install flow (live-demo material)

The whole UX is one slash command:

/plugin                                       # opens the tabbed manager (Discover / Installed / Marketplaces / Errors)
/plugin marketplace add anthropics/claude-plugins-community
/plugin install commit-commands@claude-plugins-official
/reload-plugins                               # picks up changes without restarting

Three install scopes to call out — they map cleanly to the standard Claude Code settings tiers:

For teams, the trick worth showing is extraKnownMarketplaces in .claude/settings.json — when a teammate trusts the repo folder, Claude Code prompts them to install your marketplace automatically [2]:

{
  "extraKnownMarketplaces": {
    "my-team-tools": { "source": { "source": "github", "repo": "your-org/claude-plugins" } }
  }
}

Recent UX shipped in May 2026 (mention in passing as proof the surface is still moving): v2.1.137 added type-to-filter in /plugin and /skills; v2.1.143 surfaces a Context cost estimate per plugin (tokens-per-turn); v2.1.144 shows last-updated; v2.1.145 shows a “Will install” section listing every component before you commit [21] [2].

4. Plugins worth a slide

Don’t recommend the whole shelf — pick the ones that earn their keep. Drawing from the official marketplace’s own dev workflows [2] and one of the only honest reviews [11]:

Honest aside from a hands-on review: of 10 popular plugins tested, only 4 were judged “worth keeping” — and the failures were not subtle (one was off by >2× on a basic factual lookup) [11]. Treat the marketplace like npm, not the App Store.

5. Build & ship one in 10 minutes (live-code section)

The whole quickstart fits on one slide [3]:

mkdir -p my-first-plugin/.claude-plugin my-first-plugin/skills/hello
cat > my-first-plugin/.claude-plugin/plugin.json <<'JSON'
{ "name": "my-first-plugin", "description": "demo", "version": "0.1.0" }
JSON
cat > my-first-plugin/skills/hello/SKILL.md <<'MD'
---
description: Greet $ARGUMENTS warmly.
---
Greet the user named "$ARGUMENTS" and ask how you can help.
MD
claude --plugin-dir ./my-first-plugin    # loads the plugin for this session only
# /my-first-plugin:hello Alex

Distribution path (mention, don’t demo end-to-end):

1. Push the plugin into a git repo, add a .claude-plugin/marketplace.json next to it listing your plugins with their source paths.
2. Run claude plugin validate locally — the same check the community pipeline runs [3].
3. Either tell users /plugin marketplace add your-org/your-repo, or submit to community via the in-app form at claude.ai/settings/plugins/submit.
4. CI auto-bumps the pinned commit SHA in the community catalog; nightly sync to marketplace.json [3].

Trip-wire worth flagging: relative paths in marketplace.json work only when the marketplace is added via git. If you publish a bare marketplace.json at an HTTPS URL, relative source paths silently fail to resolve [4].

6. The trust boundary — the bit that earns the slot in a security-flavoured series

This is the section that justifies plugins being slide-three after AI Security. The mechanism, in one sentence: a plugin executes arbitrary code on the user’s machine with their user privileges, just like an npm package [2]. The official docs say so in a <Warning> box:

Make sure you trust a plugin before installing it. Anthropic does not control what MCP servers, files, or other software are included in plugins and cannot verify that they work as intended. [2]

Concrete incidents to anchor the abstraction:

The defensive posture to recommend in the talk:

• Treat plugins like dependencies — review the source, pin versions, and prefer the official + community tiers over arbitrary GitHub URLs [12].
• Use managed marketplace restrictions (admin-controlled allowlist) for organisations [2].
• v2.1.145’s “Will install” section finally shows the exact commands/agents/skills/hooks/MCP/LSP a plugin will add before you confirm — make use of it [21].
• Auto-update is on by default for official marketplaces, off for third-party. Don’t blindly flip it on for community sources [2].
• Disable auto-update entirely with DISABLE_AUTOUPDATER=1; if you want plugin updates but not Claude Code itself updating, add FORCE_AUTOUPDATE_PLUGINS=1 [2].

7. Suggested session shape (60–90 min)

8. Stats and links worth name-dropping

• Official marketplace: anthropics/claude-plugins-official ⭐ 26k (May 2026) [5]
• Community marketplace: anthropics/claude-plugins-community ⭐ 119 (May 2026) [7]
• Main repo: anthropics/claude-code ⭐ 126k (May 2026) [8]
• Community directory: claudemarketplaces.com — 6,700+ skills, 2,500+ marketplaces, 840+ MCP servers indexed [14]
• Top community plugin set: obra/superpowers ⭐ 204k [17]
• Other major third-party: wshobson/agents ⭐ 36k [15], davila7/claude-code-templates ⭐ 28k [16]
• Plugin browsing UI: claude.com/plugins
• The Firecrawl “top 10 for 2026” round-up is a useful complement to the audience’s homework list [18].