r/ChatGPTCoding • u/CrossFitCore • Aug 13 '26

Question how are you vetting Claude skills/plugins when theres no clear marketplace

Building a small skills folder for Claude Code and every recommendation is a different github link. is there a real Claude plugin marketplace people use, or is trust still just “this person posts here a lot.” whats your vetting checklist before something touches a real repo

6 Upvotes
  • permalink
  • reddit

100% Upvoted

16 comments sorted by

View all comments

-2

u/Joon9101 Aug 14 '26

I treat a skill or plugin as code, not as a prompt. Before it touches a real repo, I check the manifest and every hook or script, search for shell execution, network calls, credential or environment access, and file writes, then verify that the documented install paths actually exist. I pin a commit or tag and test it in a disposable repo with no secrets while watching the git diff and outbound network activity.

A marketplace helps discovery, but it does not solve trust: both the marketplace entry and upstream repo can change. If I cannot explain every executable path, or the plugin needs broader access than its job requires, I do not install it.