Claude Code Skills Marketplace: Where Skills Live, How to Install, Publish and Vet Them

Claude Code does not have an app store. Per Anthropic's plugin documentation, a marketplace is "a directory or repository with a .claude-plugin/marketplace.json file that lists your plugins and where to fetch each one." Anyone can host one. Claude Code clones it when you add it and installs individual plugins from it by name.

Skills ride inside plugins. A plugin is a folder with a .claude-plugin/plugin.json manifest and any mix of skills, commands, agents, hooks, monitors, MCP servers and LSP servers. When people say "skills marketplace" they mean a marketplace whose plugins mostly carry skills. A plugin skill is namespaced with the plugin name, so a skill hello in plugin my-first-plugin runs as /my-first-plugin:hello.

You do not need a marketplace for one skill. A standalone skill folder in ~/.claude/skills/ loads on its own, and a plugin can be loaded for one session with claude --plugin-dir ./my-plugin. A marketplace adds two things those routes lack: install by name, and updates on request or on a schedule.

The catalog file. marketplace.json requires a name, an owner and a plugins array; each entry needs a name and a source. The source can be a relative path inside the repo, a github repo, a git-subdir (a folder inside another repo), a url to any git host, an archive zip over HTTPS, an npm package, or a command that produces the directory on the installing machine.

Anthropic's docs list two general-purpose marketplaces and several topic-specific ones. The marketplace name is what you type after @ when you install, and for the community catalog it differs from the repository name.

Names are protected. Claude Code accepts the official and community marketplace names only when the source is a github.com/anthropics/ repository, so a third-party catalog cannot pose as Anthropic's. The docs list fourteen official-tier names (among them claude-plugins-official, agent-skills, anthropic-agent-skills and knowledge-work-plugins) and three community-tier names (claude-community, claude-plugins-community, healthcare).

A deprecated name you will still see in tutorials. The claude-code-plugins marketplace inside anthropics/claude-code is deprecated; Anthropic's docs say to skip any tutorial step that runs /plugin marketplace add anthropics/claude-code and install from claude-plugins-official instead. Its ralph-wiggum plugin is now ralph-loop.

Browsing on the web. Besides the /plugin Discover tab, Anthropic's docs point to Claude Marketplace at claude.com/marketplace/plugins, which shows install counts and marks some plugins "Anthropic verified". Anthropic's directory on claude.ai is a separate catalog for claude.ai and Cowork; a plugin added there reaches Claude Code through account sync as <name>@synced.

We downloaded the four marketplace.json files above and counted every entry. The community catalog is about 7 times the size of the official one. Nearly every remote entry in both is pinned to a specific git commit (sha), which matters: per the security docs, where the community catalog pins a commit, Claude Code refuses to install a different one, so a repository owner cannot silently swap code under an existing listing.

Where the code lives. In the official catalog, 163 entries point to a git URL, 98 to a folder inside another repo, 55 sit inside the catalog repo itself and 1 uses a command source. In the community catalog, 1,876 point to a git URL, 400 to a repo subfolder and only 7 live inside the catalog repo: the community catalog is an index of other people's repositories.

Categories. The official catalog's largest categories are development (123), productivity (70), database (39), monitoring (22) and security (18). Only 7% of community entries carry a category at all, so searching the community catalog by keyword works better than browsing by category.

X data in the catalogs. No official or knowledge-work entry mentions X or Twitter in its name or description; 10 community entries do, ranging from transcription tools to social-listening plugins. None of the 2,728 entries is from TwitterAPI.io: our skill is published as a plain SKILL.md file and our MCP server is a hosted endpoint, both covered below.

Inside a Claude Code session the whole flow is two commands. /plugin market works as a short form of /plugin marketplace, and the same commands exist in your shell as claude plugin ... for scripts and for claude -p runs, where the interactive /plugin panel is not available.

Step 1: add the catalog. /plugin marketplace add accepts a GitHub owner/repo (append #ref to pin a branch or tag), a full git URL on any host, a local directory or file (start a relative path with ./ so it is not read as GitHub shorthand), or the https:// URL of a hosted marketplace.json. Private repositories work with the git credentials already on your machine; Claude Code never prompts for them.

Step 2: install by name. /plugin install <plugin>@<marketplace> opens the plugin's details instead of installing at once. The pane lists what will be installed (commands, agents, skills, hooks, MCP and LSP servers) and, for official-catalog plugins, a context cost estimate. You then pick a scope.

One-step form. Newer Claude Code builds can add and install together: /plugin install deploy-helper --marketplace your-org/plugins in a session (v2.1.275 or later) or claude plugin install deploy-helper --marketplace your-org/plugins in the shell (v2.1.292 or later).

Updates. Auto-update is on by default for claude-plugins-official and the other official names except knowledge-work-plugins and first-party-plugins, and off for the community catalog and every third-party marketplace. claude plugin update <plugin>@<marketplace> updates one plugin on demand; removing a marketplace with claude plugin marketplace remove <name> uninstalls every plugin you installed from it.

To see which marketplaces people actually pass around, we searched X for posts containing plugin marketplace add and for posts mentioning Claude Code together with a marketplace and skills or plugins. The two searches returned 240 and 484 posts from 188 and 383 distinct authors; the broader search ran at about 38.2 posts a day over 12.7 days.

Across every collected post, 281 contained a marketplace add command. Of the sources they named, 249 (85%) were third-party repositories and 41 (14%) were Anthropic's, led by anthropics/skills with 33. The third-party side is a long tail: 148 distinct sources, 73% of them named only once, and the ten most-shared accounting for 28.5% of third-party commands.

Who is talking. The marketplace conversation is multilingual: in the plugin marketplace add search, 105 posts were English, 66 Chinese, 16 Japanese and 13 Korean. Engagement is modest and skewed: the median post in the broader search had 4 likes and 341.5 views, the 90th percentile 72 likes.

Safety comes up, but not often. 13.6% of the broader marketplace posts used a word such as malicious, malware, prompt injection, security, audit or trust; in the marketplace add posts it was 7.1%. A separate search for Claude Code skills or plugins next to a security word returned 224 posts in 2.5 days, so the topic is discussed, just mostly apart from the posts that hand out install commands.

Anthropic's security page opens with the sentence that should frame every install: "A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges." A marketplace name tells you who publishes the catalog, not what each plugin does.

What runs outside your guardrails. Command hooks and monitors are shell commands that run with your full user permissions. Hooks, monitors, MCP servers, LSP servers and processes a plugin's mod starts all run outside Claude Code's sandbox, and permission rules apply only to Claude's own tool calls (calling a plugin's MCP tool, or running a file from its bin/ directory). Skills, commands and agents enter Claude's context as instructions, so a hostile skill works by steering Claude with the tools it already has.

Updates change what you reviewed. With auto-update on, the files on disk can change after your review. That is one reason third-party marketplaces default to auto-update off, and a reason to keep it off for catalogs you do not control.

The four-step review Anthropic documents. First, run claude plugin marketplace list to see where each catalog came from. Second, read the details pane's Will install section. Third, open the plugin's source and read hooks/hooks.json (the command each hook runs), .mcp.json (each server's command or URL) and every file in bin/. Fourth, clone the repository and run claude --plugin-dir <dir> plugin details <name>, which prints the component inventory without starting a session.

For teams. Managed settings let an administrator allowlist or blocklist marketplace sources, force-enable plugins, turn off --plugin-dir, limit hooks to managed ones, and stop plugins synced from members' claude.ai accounts from loading. Project scope plus a committed .claude/settings.json is how a team standardizes on a reviewed set.

Removing one. claude plugin uninstall <plugin> with the scope you used removes it; the cached files stay under ~/.claude/plugins/cache/ for 14 days unless you delete that folder yourself.

Anthropic's publishing docs describe three routes. Sending a folder or .zip reaches the people you send it to, with no updates. Your own marketplace reaches anyone who can clone the repository, with no submission form, and users get updates on request or with auto-update. Anthropic's directory on claude.ai reaches claude.ai, Cowork and Claude Code users through account sync; you submit through the developer portal at claude.ai/directory/manage, which needs a paid claude.ai plan. The docs add that claude-plugins-official does not take submissions through that portal.

What we ran. To see the author side first-hand, we wrapped our public twitterapi-io SKILL.md in a one-plugin marketplace under a temporary folder and ran Claude Code 2.1.325's validator. claude plugin validate --strict on the plugin passed, with one directory-profile note that no icon was present (the CLI adds that the directory also runs a safety scan and a policy review it does not). claude plugin validate on the marketplace passed with one warning: no marketplace description.

What it costs in context. claude plugin details reported 1 skill, 0 hooks and 0 MCP servers, an always-on cost of about 135 tokens per session, and about 3,600 tokens each time the skill fires. A skill's description is what every session pays for; the body is paid only on use.

What the validator catches. We then broke the catalog on purpose. A source of ./../plugins/twitterapi-io failed with Path contains "..", and the message explains that paths resolve from the marketplace root (the folder that holds .claude-plugin/), not from marketplace.json. A plugin named Bad Name failed twice: no spaces, and each part of plugin@marketplace may use only letters, digits, ., _ and -. A marketplace named claude-plugins-official passed the validator; per the docs the reserved-name refusal happens when someone adds the marketplace. The failing run exited with code 1 with or without --strict; --strict additionally fails on warnings, which is what you want in CI.

Release hygiene from the docs. Pick a permanent kebab-case name (a rename looks like a new plugin to every install; use the catalog's renames map if you must). Either bump version on every release or omit it so the commit SHA is the version. Pin remote sources to a sha the way Anthropic's catalogs do.

A common reason to browse a skills marketplace is to give Claude Code access to an outside data source. For X, there are three ways to wire it, and none of them needs a marketplace listing to work.

A skill. Our twitterapi-io skill is a single SKILL.md at twitterapi.io/skills/twitterapi-io/SKILL.md. Drop it in ~/.claude/skills/twitterapi-io/, set TWITTERAPI_IO_API_KEY, and Claude calls the REST API with curl or Python when a task needs X data. You can also list it in your own team marketplace as shown above. Reads need no X account.

An MCP server. Our hosted server at https://mcp.twitterapi.io/mcp takes an Authorization: Bearer <key> header and exposes X reads as MCP tools. A plugin can bundle an MCP server in .mcp.json, which is how many marketplace plugins deliver integrations; the MCP server explainer linked below covers the protocol.

What the data costs. TwitterAPI.io bills per result: $0.15 per 1,000 tweets returned (15 credits per tweet), $0.18 per 1,000 profiles, with a 15-credit minimum on each search, so a search that finds nothing costs $0.00015. On the official X API pay-per-usage rate card, a post read is $0.005, or $5 per 1,000, about 33 times more per 1,000 tweets. New accounts that pass the automatic bot check get up to $1 of free credits (at most 100,000 credits, no card, one per person or network, expiring after 31 days).

What our study cost. The X half of this page's study was 54 search requests returning 813 distinct posts, about $0.12 at $0.15 per 1,000 tweets.

Question. What do Anthropic's Claude Code plugin catalogs contain and how are entries sourced and pinned; when people on X share a marketplace, does it point at Anthropic or at third parties; and what does Claude Code's validator report for a small skill plugin?

Catalog census. One HTTPS download each of the .claude-plugin/marketplace.json files in anthropics/claude-plugins-official, anthropics/claude-plugins-community, anthropics/knowledge-work-plugins and anthropics/skills, collected in 2026: 2,728 entries. We counted source types, commit pins, categories, homepages and entries that mention X or Twitter.

X sample. Four searches through TwitterAPI.io's /twitter/tweet/advanced_search (Latest): "plugin marketplace add"; "claude code" with marketplace and skills or plugins; "claude code" with skills or plugins and a security word; and posts from the official @claudeai account about plugins, skills or marketplaces (58 posts). 54 requests, 813 distinct posts, the most recent matches at collection time, collected in 2026. Commands were parsed from post text with a regular expression; placeholder sources such as owner/repo were excluded.

First-hand run. Claude Code's claude plugin validate, claude plugin validate --strict and claude --plugin-dir ... plugin details on a temporary marketplace holding our public skill, plus a deliberately broken copy. No marketplace was added to settings and nothing was installed.

What the sample cannot show. Search returns recent posts, so it reflects a short window, not all time; it cannot see install counts, private team marketplaces or how many people installed what they saw. Catalogs change often, so entry counts are a snapshot. Keyword matching for safety terms counts words, not intent.

Privacy. Aggregates only. Topic-search authors are private individuals: raw pages were not kept in the repository, the de-identified sample has no ids, URLs, text or handles, and third-party repositories owned by individuals are counted, never named. Only Anthropic's organization repositories and the official @claudeai account are named.