Claude Code Plugin Builder
Facilitates the creation of Claude Code plugins with structured components and integration capabilities for enhanced functionality.
Install this skill
Security score
The Claude Code Plugin Builder skill was audited on Feb 9, 2026 and we found 13 security issues across 2 threat categories, including 7 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 51 | ```json |
Template literal with variable interpolation in command context
| 132 | ```json |
Template literal with variable interpolation in command context
| 148 | ```json |
Template literal with variable interpolation in command context
| 222 | | Hooks not firing | `chmod +x hooks/script.sh`, use `${CLAUDE_PLUGIN_ROOT}` | |
Template literal with variable interpolation in command context
| 223 | | MCP server fails | Use `${VAR:-}` for optional env vars, test command independently | |
Template literal with variable interpolation in command context
| 263 | ```bash |
Template literal with variable interpolation in command context
| 343 | - Use `${CLAUDE_PLUGIN_ROOT}` for paths |
Template literal with variable interpolation in command context
| 349 | - Use `${VAR:-}` for optional env vars |
Template literal with variable interpolation in command context
| 381 | - `${CLAUDE_PLUGIN_ROOT}` - Plugin directory |
Template literal with variable interpolation in command context
| 382 | - `${VAR:-}` - Optional env var |
Template literal with variable interpolation in command context
| 383 | - `${VAR}` - Required env var |
External URL reference
| 250 | - Git URL: `/plugin marketplace add https://git.server.com/plugins.git` |
External URL reference
| 403 | - [MCP](https://modelcontextprotocol.io/) |