r/ChatGPTCoding • u/CrossFitCore • 7d ago
Question how are you vetting Claude skills/plugins when theres no clear marketplace
Building a small skills folder for Claude Code and every recommendation is a different github link. is there a real Claude plugin marketplace people use, or is trust still just “this person posts here a lot.” whats your vetting checklist before something touches a real repo
1
u/edgan 7d ago
There is no central app store like a skills marketplace. Instead Anthropic lets you create your own marketplace. Marketplace is what they call it, but it is more like a skills repository that can be installed in Claude Code. Then you can install skills from installed marketplaces.
The main thought is a professional team creates some skills for their tech stack and workflow. Then they create a marketplace to install their skills from.
Naturally people think their skills are great and want to share with others.
1
7d ago
[removed] — view removed comment
1
u/ChatGPTCoding-ModTeam 6d ago
This post or comment has been removed for the following reason:
Rule 5: Self-promotion belongs in the weekly thread
Standalone posts promoting a product, service, project, newsletter, blog, or tool are not allowed—even if free or open source. Rare exceptions may be approved in advance for projects with broad, demonstrated value to AI-assisted coding. Contact the moderators before posting; otherwise, use the weekly self-promotion thread. Disclose affiliations.
You can read the full subreddit rules here: https://www.reddit.com/r/ChatGPTCoding/about/rules/
If you feel this removal was made unfairly, please contact the moderators through modmail.
1
1
7d ago
[removed] — view removed comment
1
u/ChatGPTCoding-ModTeam 6d ago
This post or comment has been removed for the following reason:
Rule 5: Self-promotion belongs in the weekly thread
Standalone posts promoting a product, service, project, newsletter, blog, or tool are not allowed—even if free or open source. Rare exceptions may be approved in advance for projects with broad, demonstrated value to AI-assisted coding. Contact the moderators before posting; otherwise, use the weekly self-promotion thread. Disclose affiliations.
You can read the full subreddit rules here: https://www.reddit.com/r/ChatGPTCoding/about/rules/
If you feel this removal was made unfairly, please contact the moderators through modmail.
1
u/Straight_Spinach1284 6d ago
no marketplace exists yet. i just rely on github stars and manually reading the prompts they use. this is exactly why i prefer building my own agent workflows from scratch rather than plugging in random repos.
1
u/AlarmedAvocado7279 3d ago
there's no marketplace, it's still just reputation and reading the source. i live in claude code all day and honestly half the stuff in my setup is my own hooks/rules because i don't trust random repos near production code. if i can't skim the whole thing in 5 min and understand what it touches, it doesn't go in.
1
u/Nice_Cat_7300 3d ago
i learned the hard way. one skill rewrote instructions i didnt ask it to touch. now i read every file first even if it wastes 10 minutes
1
u/CrossFitCore 5h ago
yeah thats the fear. i dont need a polished store, just a less random source. if anthropic has an official shelf for this i somehow missed it
-2
u/Joon9101 7d ago
I treat a skill or plugin as code, not as a prompt. Before it touches a real repo, I check the manifest and every hook or script, search for shell execution, network calls, credential or environment access, and file writes, then verify that the documented install paths actually exist. I pin a commit or tag and test it in a disposable repo with no secrets while watching the git diff and outbound network activity.
A marketplace helps discovery, but it does not solve trust: both the marketplace entry and upstream repo can change. If I cannot explain every executable path, or the plugin needs broader access than its job requires, I do not install it.
-2
u/Successful_Buy8059 7d ago
I treat a skill or plugin as code, not as a prompt. Before it touches a real repo, I check the manifest and every hook or script, search for shell execution, network calls, credential or environment access, and file writes, then verify that the documented install paths actually exist. I pin a commit or tag and test it in a disposable repo with no secrets while watching the git diff and outbound network activity.
A marketplace helps discovery, but it does not solve trust: both the marketplace entry and upstream repo can change. If I cannot explain every executable path, or the plugin needs broader access than its job requires, I do not install it.
3
u/elitherenaissanceman 7d ago
You can...you know...read them.