plugins/agent-scaffolders/skills/manage-marketplace/SKILL.md
This skill should be used when the user wants to "create a marketplace", "setup a marketplace catalog", "scaffold marketplace.json", "initialize a plugin registry", or "configure a Gemini CLI extension". Use this even if they just mention "setting up a marketplace".
npx skillsauth add richfrem/agent-plugins-skills manage-marketplaceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Guidelines for authoring, appending, and distributing plugin marketplace catalogs.
To create a new marketplace:
.claude-plugin/ directory at the root.marketplace.json file inside .claude-plugin/.{
"name": "my-marketplace",
"owner": {
"name": "My Name",
"email": "[email protected]"
},
"plugins": []
}
Reserved names (blocked by Claude Code):
claude-code-marketplace,claude-code-plugins,claude-plugins-official,anthropic-marketplace,anthropic-plugins,agent-skills,knowledge-work-plugins,life-sciences. Names that impersonate official marketplaces (e.g.official-claude-plugins) are also blocked.
To add entries to your marketplace plugins list:
name (kebab-case).source — choose the type that matches your hosting:Same-repo subdirectory (monorepo — verified working)
{ "source": "./plugins/my-plugin-folder" }
Path is resolved relative to the marketplace root (the directory containing .claude-plugin/), not from .claude-plugin/ itself. Must start with ./.
Note: Relative paths only work when the marketplace is added via Git (GitHub, GitLab, git URL). If added via a direct URL to
marketplace.json, relative paths fail — usegithub,npm, orurlsources instead.
GitHub repository
{ "source": { "source": "github", "repo": "owner/repo", "ref": "v2.0.0", "sha": "a1b2c3d..." } }
ref and sha are optional. Omit to use the default branch.
Monorepo subdirectory via sparse clone (avoids fetching whole repo)
{ "source": { "source": "git-subdir", "url": "https://github.com/owner/repo", "path": "plugins/my-plugin" } }
Note: field is path (not subdir), and the key is source (not type). Also accepts GitHub shorthand or SSH URLs.
npm package
{ "source": { "source": "npm", "package": "@scope/my-plugin", "version": "^1.0.0", "registry": "https://registry.npmjs.org" } }
version defaults to latest; registry defaults to the public npm registry.
Non-GitHub git host
{ "source": { "source": "url", "url": "https://gitlab.com/owner/repo.git", "ref": "main" } }
The .git suffix is optional — Azure DevOps and AWS CodeCommit URLs without it work fine.
Set strict mode (always set this explicitly — never rely on the default):
| Value | Requires | Behavior |
|-------|----------|----------|
| true (default when omitted) | Plugin must have its own plugin.json | plugin.json is authoritative; marketplace entry supplements it |
| false | Plugin must NOT have a plugin.json that declares components | Marketplace entry IS the entire definition |
Both failure modes cause the entire plugin to silently fail to load:
strict: true (or omitted) + no plugin.json → load failure (authority source missing)strict: false + plugin has a plugin.json declaring components → conflict = load failureBest practice for monorepo plugins: Always set
"strict": trueexplicitly and ensure your plugin directory has a.claude-plugin/plugin.json. Never omitstrictand assume the default will work.
Optional: use metadata.pluginRoot to shorten relative source paths. Setting "pluginRoot": "./plugins" lets you write "source": "formatter" instead of "source": "./plugins/formatter".
Optional: pin a version. Warning: do not set version in both the marketplace entry and the plugin's plugin.json — plugin.json wins silently and the marketplace version is ignored. For relative-path plugins, set version in the marketplace entry. For all other sources, set it in plugin.json.
Plugin Author Note: In hooks or server configs, use
${CLAUDE_PLUGIN_ROOT}(read-only install path) and${CLAUDE_PLUGIN_DATA}(persistent state directory) instead of absolute host paths.
Run validation to catch schema errors before consumers see them:
/plugin validate .
# or via CLI:
claude plugin validate .
Validator checks: plugin.json, skill/agent/command frontmatter, hooks/hooks.json syntax and schema.
Common errors:
| Error | Solution |
|---|---|
| File not found: .claude-plugin/marketplace.json | Create the file with required fields |
| Duplicate plugin name "x" | Give each plugin a unique name |
| plugins[0].source: Path contains ".." | Use paths without .. |
| YAML frontmatter failed to parse | Fix YAML syntax in the skill/agent file |
.claude-plugin/marketplace.json at the repo root (not inside a subdirectory).main).Consumers register the marketplace with:
/plugin marketplace add owner/repo
Example: /plugin marketplace add richfrem/agent-plugins-skills
On success, Claude Code responds: Successfully added marketplace: <name>
Known non-working subcommands (Claude Code 2.1.81):
/plugin marketplace browse — returns no content, not a supported subcommand/plugin list or /plugin help to discover what subcommands are available in your versionAfter adding the marketplace, install any listed plugin by name:
/plugin install <name>
This opens an interactive Plugins panel (not plain text output) showing:
marketplace.jsonScope flags (if using CLI directly):
/plugin install <name> — user scope (default)/plugin install <name> --scope project — team shared/plugin install <name> --scope local — machine localNote: The command returns no stdout — the install UI renders in the Plugins panel, not the terminal.
After install, run /reload-plugins to activate immediately without restarting. Output format:
Reloaded: N plugins · N skill · N agents · N hooks · N plugin MCP servers · N plugin LSP server
/plugin)Running /plugin with no arguments opens the full plugin manager with tabs:
Shows each registered marketplace with:
• claude-plugins-official * ← * = built-in/pinned
anthropics/claude-plugins-official
117 available • 2 installed • Updated 3/22/2026
• my-marketplace-id
owner/repo
27 available • 1 installed • Updated 3/22/2026
Keybindings: Enter select · u update · r remove
Selecting an installed plugin shows:
plugin-name @ marketplace-id
Scope: project
Version: 2.0.0
<description>
Author: Author Name
Status: Enabled
Installed components:
• Skills: skill-a, skill-b
Options: Disable plugin · Mark for update · Update now · Uninstall · View repository · Back to plugin list
.claude/settings.json){
"extraKnownMarketplaces": {
"my-marketplace-id": {
"source": {
"source": "github",
"repo": "owner/repo"
}
}
},
"enabledPlugins": {
"my-plugin@my-marketplace-id": true
}
}
extraKnownMarketplaces is a keyed object (not an array) where the key is the marketplace ID (kebab-case). enabledPlugins is also a keyed object using the format "plugin-name@marketplace-id": true. Both make the marketplace and plugin available by default for every team member.
strictKnownMarketplaces in managed settings restricts which sources users can add:
{ "strictKnownMarketplaces": [] } // complete lockdown
{ "strictKnownMarketplaces": [{ "source": "github", "repo": "acme/approved" }] } // allowlist
{ "strictKnownMarketplaces": [{ "source": "hostPattern", "hostPattern": "^github\\.example\\.com$" }] } // regex on host
{ "strictKnownMarketplaces": [{ "source": "pathPattern", "pathPattern": "^/opt/approved/" }] } // regex on path
Note: this is a policy gate only — it does NOT register marketplaces. Pair with extraKnownMarketplaces to pre-register allowed ones.
export CLAUDE_CODE_PLUGIN_SEED_DIR=/path/to/pre-installed-plugins
# Seed directory mirrors ~/.claude/plugins structure (known_marketplaces.json, marketplaces/, cache/)
# Seed entries are read-only — auto-updates disabled for seeded marketplaces
# To layer multiple seed dirs, separate with : (Unix) or ; (Windows)
Point two marketplace entries at different ref values of the same repo:
{ "name": "stable-tools", "plugins": [{ "name": "my-plugin", "source": { "source": "github", "repo": "acme/plugin", "ref": "stable" } }] }
{ "name": "latest-tools", "plugins": [{ "name": "my-plugin", "source": { "source": "github", "repo": "acme/plugin", "ref": "latest" } }] }
Each ref's plugin.json must declare a different version — same version = Claude Code treats them as identical and skips the update.
/plugin marketplace list # list all registered marketplaces
/plugin marketplace update <name> # refresh catalog from remote
/plugin marketplace remove <name> # remove (also uninstalls its plugins)
/plugin install <plugin>@<marketplace> # install (user scope default)
/plugin disable <plugin>@<marketplace> # disable without uninstalling
/plugin enable <plugin>@<marketplace> # re-enable
/plugin uninstall <plugin>@<marketplace> # remove completely
claude plugin install <plugin> --scope project # install at specific scope
Shortcuts: /plugin market = /plugin marketplace, rm = remove.
| Variable | Purpose |
|---|---|
| CLAUDE_CODE_PLUGIN_SEED_DIR | Pre-populate plugins for containers/CI |
| CLAUDE_CODE_PLUGIN_GIT_TIMEOUT_MS | Git clone/pull timeout in ms (default: 120000) |
| GITHUB_TOKEN / GH_TOKEN | Auth for private GitHub marketplace repos (auto-updates) |
| GITLAB_TOKEN / GL_TOKEN | Auth for private GitLab repos |
| BITBUCKET_TOKEN | Auth for private Bitbucket repos |
| FORCE_AUTOUPDATE_PLUGINS=true | Keep plugin auto-updates on when DISABLE_AUTOUPDATER is set |
skillsmp.com auto-indexes open-source SKILL.md skills from GitHub daily.
SKILL.md files containing name + description frontmatterclaude-skills and/or claude-code-skillTODO: CHECK INDEXING - Topics added to
richfrem/agent-plugins-skillson 2026-03-22. Verify at skillsmp.com after 2026-03-23.
Skills at plugins/<plugin>/skills/<skill>/SKILL.md (4 levels deep) may not be crawled. If not indexed after first sync, add a top-level skills/ directory mirroring the skill folders.
To ensure your repository is installable as a native extension suite in the Gemini CLI, you must provide a manifestation file in the root directory.
gemini-extension.jsonThe manifest defines the identity and behavior of the extension:
{
"name": "my-extension-id",
"version": "1.0.0",
"description": "Universal Agent Plugins & Skills extension.",
"contextFileName": "GEMINI.md"
}
GEMINI.mdThe contextFileName (usually GEMINI.md) serves as the "Instruction Profile" for the session.
gemini extensions install https://github.com/owner/repo
data-ai
Task management agent. Auto-invoked for task creation, status tracking, and kanban board operations using Markdown files across lane directories. V2 enforces Kanban Sovereignty constraints preventing manual task file edits.
development
Create, audit, repair, and document cross-platform symlinks that work correctly on both Windows and macOS/Linux. Use this skill whenever the user mentions symlinks, symbolic links, junction points, .gitconfig symlinks, broken links after git pull, cross-platform path issues, or needs help with ln -s equivalents on Windows. Also trigger when the user reports that files are missing or wrong after switching between Mac and Windows machines using Git. This skill solves the common problem where symlinks committed on macOS show up as plain text files on Windows (and vice versa) because of Git's core.symlinks setting or missing Developer Mode / elevated permissions. **IMPORTANT FOR WINDOWS USERS:** Developer Mode must be enabled before creating symlinks. Without it, Git will check out symlinks as plain-text files or hardlinks, breaking cross-platform workflows.
development
Interactively prepares a targeted Red Team Review package. It conducts a brief discovery interview to determine the threat model, generates a strict security auditor prompt, compiles a manifest of relevant project files, and bundles them into a single Markdown artifact or ZIP archive ready for an external LLM (like Grok, ChatGPT, or Gemini) or a human reviewer.
tools
Reduces AI agent context bloat across three dimensions: (1) duplicate skill deduplication — clears stale agent directory copies since the IDE already reads from plugins/ directly; (2) instruction file optimization — rewrites CLAUDE.md, GEMINI.md, or .github/copilot-instructions.md to under ~80 lines, keeping only rules that directly change agent behaviour; (3) session token efficiency — guidance on cheap subagent delegation, context compounding across turns, and session hygiene. Trigger with "optimize context", "reduce context bloat", "deduplicate skills", "trim CLAUDE.md", "trim GEMINI.md", "fix my context usage", "why are my skills loading twice", "how do I reduce token usage", or "clean up agent directories".