Review a Claude Code plugin before installing it

A plugin can package skills, agents, commands, hooks and MCP connections. Those parts do different things. This original checklist helps you inspect an exact source version before deciding whether to install it. The linked template library is an external reference, not a RocketLauncher endorsement of every component.

2 min de leitura

8 seções

Atualizado em 9 de outubro de 2026

Nesta página

1Compatibility
2How to use it
3Example
4What you get
5Limits
6Download
7Status
8Sources

Compatibility

Manual review checklist for Claude Code plugins and extensions. Does not install a plugin or execute its hooks.

How to use it

Choose the exact source repository and record a commit or release instead of reviewing an unspecified latest version.
Read the manifest and inspect each hook, command and dependency without executing it.
Check the license, supported client and requested access. Stop if the purpose of a permission or script is unclear.
After review, follow the author's installation and removal instructions in a disposable project, then record the result.

Example

What you get

A source-linked review with a pinned version, access requirements and a tested removal plan.

Limits

Static review cannot prove that an extension is safe in every environment.
A Claude Code plugin is not automatically a Codex skill or a ChatGPT connector.
External resources remain on their original sites; we do not redistribute their code.

Download

The file is our own work, under the MIT license. Download plugin-review.md.

# Review a Claude Code plugin

Source URL:
Author:
Commit or release:
License:
Supported client/version:

1. Read the plugin manifest and the exact pinned source.
2. List skills, commands, agents, MCP servers and hooks separately.
3. Inspect hook commands and installation scripts without running them.
4. Record network destinations, environment variables and requested permissions.
5. Reject unexplained secret access, destructive commands or untrusted downloads.
6. Test the approved component in a disposable project with no production credentials.
7. Record installation and removal steps from the source documentation.
8. Keep the source version and review result. A newer release needs another review.

Do not treat a marketplace listing, download count or this checklist as a security guarantee.

Status

Version 1.0.0, updated 2026-10-09. Review status: reviewed. Original instructions reviewed and file structure validated locally. Client installation and account-specific execution are not certified.

Sources

Claude Code plugin documentation by Anthropic. Reference only.
Claude Code Templates source by davila7 and contributors. External repository; verify each component's license before reuse.