claude-code-plugin-development
Enables users to create and manage distributable plugins for Claude Code, enhancing functionality with commands, agents, and skills.
Install this skill
Security score
The claude-code-plugin-development skill was audited on Feb 9, 2026 and we found 9 security issues across 3 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 108 | Use `${CLAUDE_PLUGIN_ROOT}` for paths in hooks and MCP configs: |
Template literal with variable interpolation in command context
| 110 | ```json |
Template literal with variable interpolation in command context
| 149 | "!`${CLAUDE_PLUGIN_ROOT}/scripts/my-script.sh 2>&1 || true`": |
Template literal with variable interpolation in command context
| 157 | ```yaml |
Template literal with variable interpolation in command context
| 163 | ```bash |
Template literal with variable interpolation in command context
| 206 | - [ ] All paths use `${CLAUDE_PLUGIN_ROOT}` variable |
Access to hidden dotfiles in home directory
| 101 | | user | `~/.claude/settings.json` | Personal plugins (default) | |
Access to hidden dotfiles in home directory
| 174 | The plugin may be disabled. Check `~/.claude/settings.json`: |
External URL reference
| 10 | **Official docs:** https://code.claude.com/docs/en/plugins-reference |